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TASK AUTHORIZATION FORM 


Commitment Number (PR): 152548 Financial Coding: 0500-0140-6762-54080- 
RE p254 panana codme 7 o 
Task Number: 7113956 Amendment Number: |002 
D y ements ES 
ee 


Amendment #002 is raised to add additional milestones for Transformation Office Operation and increase the 
alue of the TA by $550,425.00 for services, plus $82,426.14 for applicable taxes, for a total increase of 
$632,851.14. 


Amendment #001 is raised to correct the basis of payment and reduce the total TA value by $632,851.14 taxes 
included. 


This Task authorization addresses two areas of work: 
1. Transformation Office Design and Operation 
2. Power Platform MVP for Chinook 


Description of the Project / Work Required —Transformation Office Design and Operation 
BACKGROUND: 


IRCC has defined a bold transformation vision to become the world leader in migration. The pressures created by the 
COVID-19 pandemic have increased the urgency of accelerating key elements of this transformation. As IRCC 
mobilizes to undertake this ambitious enterprise wide digital transformation, a central body must be established to 
orchestrate the transformation. 


This central body — the transformation office — will be responsible for governing and ensuring the success of a multi- 
million-dollar transformation program that is critical to the revitalization efforts for IRCC. In addition, the global 
pandemic laid bare our limitations and has further reinforced the urgency of making our operations fundamentally 
digital so that our immigration system is more nimble and resilient. For the Transformation Office to be effective, it must 
be designed and operated with the appropriate organizational structure, capabilities, and roles required to enable 
SUCCESS. 


IRCC has begun work to define the Transformation Office scope and mandate. The engagement to design the 
transformation office will build on the work completed to date and refining to accelerate the mobilization of the 
transformation office. 


Establishing an effective Transformation Office with the right capabilities must be staffed with employees with the right 
skillsets and practical experience to operate it effectively. Accenture can support by providing contracted resources 

ith the right experience and skillsets to not only help operate the Transformation Office in the short term but also to 
help coach and upskill IRCC employees to support an evolution to a fully staffed Transformation Office with mature 
capabilities to manage the transformation efforts. 


TASKS 


For the Transformation Office Design, the Contractor will: 
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= Review and refine existing inputs from IRCC Transformation Office design to analyze organizational structure 
options (e.g., centralized vs. decentralized) and recommend the selection of the appropriate model 

= Review and refine key roles and skillsets required to support the Transformation Office 

= Review and refine the core capabilities within the Transformation Office 

» Leverage existing documentation to refine structures and processes underpinning the capabilities (e.g., 
delivery governance, benefits reporting) 

» Review and refine the activities and flow of inputs and action between the Transformation Office and key 
partners within IRCC (e.g., strategic policy & planning, DPM, ePMO, Technology) and outside IRCC (e.g., 
SSC, CBSA, IRB) 

= Define evolution stages to achieve the target state Transformation Office Build Program delivery roadmap 

= Outline how the Transformation Office should evolve as the transformation progresses and matures 

= Stand up key capabilities within the Transformation Office leveraging Accenture resources 

= Develop the supporting templates and tools to enable activation of core capabilities 

= Support definition and activation of Digital Journeys with industry and technology expertise 


A high-level timeline of the design phase is provided in Figure 1 below. 


Figure 1 High Level Timeline 
DELIVERABLES 
For the design of the transformation office, the Contractor will provide the following deliverables: 


= Organizational structure (including roles and skillsets) 

= Capability model & scope of delivery 

= Interaction model between transformation office & IRCC 

= Transformation Office evolution stages 

= Mobilize the Transformation Office 

= Support the ongoing operation of the Transformation Office 


Deliverable Inspection and Acceptance: The Project Lead, on behalf of the Technical Authority, will inspect and 
accept the deliverables within 3 business days of submission from the Contractor. The Deliverable will be deemed 
accepted after two (2) weeks from the date all Deliverables were submitted to the Technical Authority. 


Description of the Project / Work Required — Power Platform MVP for Chinook: 
BACKGROUND: 
As the Government of Canada returns to business in a new COVID reality and the volume of Temporary Resident Visa 


applications increases, the IRCC needs to act quickly to automate a currently manual part of the process for 
Temporary Resident Visas by developing and implementing a replacement solution for the current Chinook Application. 
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Global Case Management System (GCMS) is the core application at IRCC to process applications. Due to limitations 
of GCMS around performance and user interface, overseas processing centers started building local applications to 
manage workload. Chinook was launched to replace these local applications and consolidate them into single solution. 
Chinook is an Excel based application that consists of 6 modules namely 1) File Management, 2) Pre-Assessment, 3) 
Decision Maker, 4) Post-Decision, 5) Indicator Management and 6) Quality Assurance. The existing Chinook solution 
has issues around stability and scaling additional features. With the return to business in the current COVID reality and 
associated increases in volume, these issues have become more exasperated so that the IRCC now is looking for a 
replacement that can be rolled out in a rapid timeframe. 


Module 3, which is the ‘Decision Maker Module’ is in scope for the Power Platform MVP along with capabilities within 
Modules 4 and 5 that are incorporated in Module 3. The majority of visa processing offices in Canada and overseas 
use Chinook, and it is estimated that approximately 1,000 users (500 overseas and 500 in Canada) will use the 
replacement solution as part of this MVP. Power Platform was evaluated and is being considered as a replacement to 
Chinook. One of the key objectives of this MVP is to validate Power Platform as a solution, that can meet the IRCC’s 
requirements which are currently served by Chinook. 


TASKS 
For the Power Platform MVP for IRCC’s Chinook replacement, the Contractor will: 


e Provide support to the Technical Authority’s infrastructure team to setup the Development and Production 
instances of Dynamics 365 CE (D365). These instances will be provisioned on the Technical Authority’s 
Azure tenant and will be federated with the tenant’s Azure Active Directory (AAD) to enable the user 
authentication. 

e Following agile approaches to development, the contractor will build MVP core functionality as defined in 
Sprint Planning sessions and based on prioritizations of user stories by the IRCC Journey Owner. The initial 
vision for the MVP roadmap is outlined below. The requirements outlined are provided as a high-level 
roadmap of the user stories and do not constitute a statement of full specifications to be developed in this 
release. It is expected and anticipated that user stories will be added or removed throughout the agile 
process. Services will be performed subject to available capacity as indicated in the staffing below 

o Undertake core platform configurations pertaining to workflow, business unit hierarchy, teams, user 
setup, and setup of the D365 role security model which provide the basis for further development. 

o Enable the D365 language pack to support the English and French interface on the platform. French 
translations of custom components (entities, fields, labels, headers) will be provided by Technical 
Authority which will be imported into the platform by the Contractor. 

o Build integration components to consume the GCMS extract (fixed format csv extracts). These 
extracts will be generated at a predefined location by the Technical Authority that is accessible by 
the cloud service. No integration will be built to push the decision data back into GCMS and the 
decisions will be manually copied into GCMS by the application user. 

o Undertake upload of existing master tables and configuration tables in D365 using the cleansed 
data provided by Technical Authority in a predefined format (Excel or in a staging data). These 
tables will be used at various places in the application form as masters. 

o Configure out-of-the-box search capability of D365 for users to be able to search for specific 
application forms filtering on predefined search attribute (application id). 

o Build the user interface (UI) using D365 forms for viewing the application and associated data. This 
will be the primary UI for users to view the application data. Besides the individual UI forms, D365 
views will be configured to view the application data in bulk. 

o Build the mechanism to capture decisions and action notes on Temporary Resident applications. 
Four templates will be configured to capture the application decisions in a structured manner. 

o Configure two end user dashboards (out-of-the-box configurations) that provide a snapshot and list 
view of applications and application status. 

o Build custom rules to surface indicator flags on the application that match the criteria (up to 25 
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criteria in total). The rules will be triggered on the data that is already ingested by D365 as part of 
the original data upload. 
e Provide Systems Integration Testing (SIT) and User Acceptance Testing (UAT) support for a one-week period 
(combined). 
e Provide hypercare support post MVP rollout for a 2-week period. 
e Develop a potential application operations support approach, model, and plan for Power Platform. 


A high-level timeline is provided in Figure 2 below. 


Figure 2 High Level Timeline 


The following activities are Out of Scope for the Power Platform MVP and not included in the tasks to be completed by 
the Contractor. 


e Development of a mobile application and/or modifying legacy applications. 

e Power BI reporting for which estimates can be provided for a subsequent release, if requested. 

e Integration with GCMS. 

e Data cleansing and historical data migration. 

e Performance, penetration and load testing. Any mitigation on performance issues is not included and it is 
assumed that the native performance of the CRM application is sufficient. 

e Integration with any third-party authentication provider for user authentication/authorization. 

e Change management activities including the development of communication strategies and plans for the 
application launch. 

e Security testing and/or certification of the Technical Authority's application. 

e Warranty and ongoing support beyond the Hypercare period. 

e Functional workshops for process re-engineering. 

e Modifications/extensions beyond the out-of-the-box language pack capability. French Language translations 
for all custom entities and attributes of the application including portals, screens, forms and training materials 
which will be provided by the Technical Authority. 

e Pre assessment notes (Module 2 of Chinook) are not included as part of this MVP build and these 
enhancements/extensions may be included in subsequent releases. 


DELIVERABLES 


For the Power Platform MVP for IRCC’s Chinook replacement, the Contractor will provide the following six 
deliverables: 


e High-level implementation plan for the MVP build. The implementation plan will be modified based on the 
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outcomes of the ‘Plan and Design 2’ phase of the project. The implementation plan is a high-level roadmap of 
the potential future releases and is a 2-3 slide deck. 

e High-Level product and integration requirements backlog — This backlog will cover the user stories that 
will be delivered in sprints. The user stories will be refined and updated in the ‘Plan and Design 1’ phase and 
then prioritized in ‘Plan and Design 2’, with clear acceptance criteria included with each user story, to confirm 
the application build scope. 

e One-time data migration for master data. Cleansed master data provided by the Technical Authority in a 
pre-defined format will be uploaded in D365. 

e Data upload component — Six csv-based Enterprise Data Warehouse (EDW) extracts (provided by the 
Technical Authority on a shared location accessible by the cloud service) will be ingested into D365. 

e High-level solution architecture document of the build covering Technical Authority specific configurations 
and customizations. 


e Potential approach, model and plan for application operations support for Power Platform 


Deliverable Inspection and Acceptance: The Project Lead, on behalf of the Technical Authority, will inspect and 
accept the deliverables within 3 business days of submission from the Contractor. The Deliverable will be deemed 
accepted after two (2) weeks from the date all Deliverables were submitted to the Technical Authority. 


Roles and Responsibilities Contractor Technical 
Authority 


Development TestandrodsionEmionmen'seup [t+ RA 
Pramene [RAR 
a u a E 
Cu resing an Bug T S 


CU preparator ang sean Ra 
Tanna (806, raie ane RA 


R: Responsible — Responsible for the performance of the work 

A: Accountable — Ultimately responsible for activity; includes Yes/No authority 
C: Consulted — Provides guidance and support 

|: Informed — Must be informed of actions, progress and decisions. 


3. Work Location: N/A — All work to be conducted remotely. 
4. Invoice sent to: IRCC.DSBFINANCEADMIN- ES AE Eiee IRCC@cic.gc.ca 
of invoice to: carole.holden GC. 


Page 5of 11 


000005 


Immigration, Refugees Immigration, Réfugiés 
il + il and Citizenship Canada et Citoyenneté Canada 
Information disclosed under the Access to Information Act 
L'information divulquée en vertu de la loi sur l'accès à l'information 


s.19(1) S.20(1)(b) 


5. Travel Requirements: N/A — All work to be conducted remotely. 


6. Language Requirements: English. 


8. Level of Security Clearance Reliability Status. 
Required for the Contractor 
Personnel: 


9. Contractor’s Response: 
9.1 Milestone Payment Schedule 


Payment Milestone | Week | Firm Price Amount (Taxes Extra) 


4. Transformation Office | 
Capability Model and Delivery Week 4 of Transformation Office 


Scope Design and Operation 

5. Transformation Office Evolution Week 8 of Transformation Office 
stages Design and Operation 

6. Transformation Office Ongoing 

Operations Month 1 End of January 2021 

7. Transformation Office Ongoing 

Operations Month 2 End of February 2021 

8. Transformation Office 

Operations Month 3 gee 


9.2 Total Cost 
Cost Breakdown: 


A.1 Application/ Software Architect 
— Level 3 


1.11 Technology Architect — Level 2 


A.11 Tester — Level 1 
A.6 Programmer/ Software 
Developer — Level 1 
A.6 Programmer/ Software 
Developer — Level 2 


P.8 Project Leader — Level 3 
B.3 Business Consultant — Level 2 


B.3 Business Consultant - Level 2 


P.1 Change Management 
Consultant - Level 1 


B.3 Business Consultant - Level 1 
P.8 Project Leader - Level 3 


P.5 Project Executive - Level 3 


P.8 Project Leader - Level 2 


P.8 Project Leader - Level 2 


Page 6 of 11 
000006 


Immigration, Refugees Immigration, Réfugiés 
il + il and Citizenship Canada et Citoyenneté Canada 
s.1 9(1 ) Information disclosed under the Access to Information Act 
L'information divulquée en vertu de la loi sur l'accès à l'information 


s.20(1)(b) 
B.3 Business Consultant - Level 2 
B.3 Business Consultant - Level 1 
B.3 Business Consultant - Level 1 TBC TBC 
Amendment #001 


P.1 Change Management 
Consultant - Level 1 


P.8 Project Leader - Level 3 


P.5 Project Executive - Level 3 
P.8 Project Leader - Level 2 
P.8 Project Leader - Level 2 


B.3 Business Consultant - Level 2 
B.3 Business Consultant - Level 1 
B.3 Business Consultant - Level 1 TBC TBC 


Amendment #002 
P.1 Change Management 
Consultant - Level 1 
P.8 Project Leader - Level 3 
P.5 Project Executive - Level 3 


| SubTotal or TA (Taxes Extra) (AN | $4,387,025.00_ 
Applicable Taxes (8): | $207,706.99 


Total Cost of TA (Taxes included) (C= 


9.3 Key Contract Assumptions and Dependencies: 


Assumptions 

e The Applicable Basis of Payment is a Firm TA Price for the tasks and deliverables identified in Section 1 

e The Applicable Method of Payment is milestone payments for the milestones outlined in Section 9.1 

e The Technical Authority will be responsible for the development of interfaces from and to existing IRCC 
systems. 

e Contractor personnel will not have access to the IRCC production environment and production data, including 
but not limited to Personal Identifiable Information (PII) data. Any communication with Contractor will require 
the Technical Authority to ensure that no production or PII data is present. 

e The Technical Authority will be responsible for deploying the Chinook application into the production 
environment and subsequently will be responsible for the operations, support, and maintenance. 

e Contractor personnel will not be part of the production operations and maintenance support for the production 
environment. 

e The project will be executed remotely with all working sessions, meetings, and workshops to be conducted 
virtually. Further details are provided in Appendix 1 (“Remote Work Protocols”). 

e The Technical Authority will be responsible for the training and change management that is required as part of 
new and changed business processes. 

e The Technical Authority will be responsible for all infrastructure and environments and the associated costs, 
including the Microsoft Azure environments. 

e The Technical Authority will be responsible for timely participation of IRCC technology and business 
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stakeholders in planned working sessions, workshops, interviews, meetings, and demos throughout the 
project. 

e The Technical Authority will be responsible for IRCC technology and business executive stakeholder 
availability for timely decision-making throughout the project. 

e The Contractor and/or IRCC may propose a change to the scope, terms or conditions of this Task 
Authorization and such change shall only be effective when it is set forth in a writing executed by authorized 
representatives of all Parties ("TA Amendment’). Once approved, such a change will be deemed to 
supplement or modify, as applicable, the terms and conditions of this TA to which it pertains. 


The following additional scope specific assumptions and dependencies are included for the Transformation Office 
Design and Operation are provided below: 


e Appropriate IRCC business stakeholders are available for day-to-day collaboration throughout the design and 
operation of the Transformation Office, including subject matter experts for the projects branch and IT 
operations. 

e Access to material from previous and current Transformation Office materials developed to date as an input to 
be reviewed and refined as part of the Transformation Office organizational design, delivery scope definition, 
and identification of interactions. 


The following additional scope specific assumptions and dependencies are included for the Power Platform MVP as 
provided below: 


e The native mechanism for user authentication will be leveraged that uses Azure Active Directory as identity 
provider. 

e EDW is the primary source of data for Chinook and is extracted from GCMS. EDW extracts (csv) will be 
manually moved by IRCC teams to file share on cloud. This file share is accessible by Cloud service (Power 
Automate, D365 online). 

e An integrated SIT environment will be provisioned by the IRCC’s infrastructure team to conduct the test run. 

e Native encryption technology provided by Dynamics 365 will be leveraged to encrypt data at rest and during 
transit between user devices and data centers. 

° Out-of-the-box audit will be enabled to track changes made by users on the application data. 

e The Dynamics 365 unified interface (versus mobile applications) will be used by all users of the Power Platform 
MVP. 

e Language translations will be provided by the Technical Authority before start of Sprint 3, if required 

° The offline capability offered out-of-the-box by the platform is sufficient to meet the requirements of low 
bandwidth areas. 

e The Technical Authority will work together with Contractor to create and provision the pre-production 
environment according to the agreed upon release plan and timelines. The Technical Authority will provide full 
access to the DEV environment, suitable access to the TEST environment to enable Contractor resources to 
perform testing, troubleshooting and deployments. 

° The Technical Authority is responsible for deployments to non-development environments and will make 
available deployment resources with adequate skills and availability that can successfully follow deployment 
instructions and ensure releases are deployed within the timeframes required. The Contractor’s team can assist 
Technical Authority in building the deployment processes. 

e The Technical Authority will procure licenses for the 3rd party applications, including licensing to enable the 
deployment of each 3rd party application in each CRM environment (DEV, TEST, etc.). 

e The Technical Authority will be responsible for troubleshooting any firewalls, infrastructure / network security; 
and related IT hurdles that may arise. 

e The Technical Authority will provide production quality test data for the user stories in the upcoming sprint. Test 
data will be provided in a format specified by the Contractor. Test data will be obfuscated by the client. 

e The Technical Authority will provide production quality test data prior to the test phase. Test data will be provided 
in a format specified by the Contractor. 
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e The Contractor will provide one developer for two weeks past the MVP release to handle incidents and bugs (i.e. 
tier 3 support) for the application. 


Dependencies: 

e Security certification of the Power Platform and the on-premise to online data gateway setup (associated with 
Protected B guidelines, gateway hardening and connectivity through SIGNET) to be completed by Microsoft, 
IRCC’s security team and IRCC’s technology operations team prior to the pilot rollout. 

e Connectivity with the Power Platform for overseas offices who use a GAC system via Signet to be provisioned 
by Microsoft, IRCC’s Security team and IRCC’s technology operations team in order to allow the application to 
be accessed in overseas offices prior to the pilot rollout. 

e The key roles of Project Manager, Product Owner, Functional SME and Technical SME to be identified and 
assigned by the Technical Authority prior to the start of the project with sufficient capacity to support the Power 
Platform MVP project. 

e All available, relevant documentation, including high-level business process diagrams, and user story backlog to 
be provided by the Technical Authority prior to the start of the project. 

° Environment provisioning to be completed prior to the start of the project by IRCC’s infrastructure, security, and 
technology operations teams. 

e Environment access and domain credentials for the Contractor team members to be provided by IRCC’s 
infrastructure, security, and technology operations teams within two days of project start-up including access to 
following applications: 


e Backlog management tool for the project (Azure DevOps Boards, Jira); 

e Development tools (Visual Studio, Code Repository); 

° D365 development instance; 

e Power automate environment with relevant access to create new flows; 

e Access to EDW Extracts on the shared folder (or the location from where it is to be consumed); 
and 

@ Configuration/Master Data for upload. 


e Production deployment and rollout to be led by the IRCC infrastructure and technology operations teams, with 
support and guidance from the Contractor on setting up the deployment processes. The Contractor SME will 
lead the discussions as required bridging the knowledge gap from Power Platform perspective. 

e The IRCC technology operations team, IRCC Technical SME and IRCC Functional SME to store EDW extracts 
on file share that is accessible by the cloud service (6 csv files) in week 1 of the project. For purposes of the 
MVP, the csv extracts from EDW must be manually moved to a file share location that is accessible by the cloud 
service (Power Automate, D365). 


Appendix 1 
Remote Work Protocols 


This Appendix 1 sets out the remote work protocols to be followed by the Parties. In response to employee health and 
safety concerns related to the COVID-19 outbreak, the Parties have agreed that the Contractor will implement a 
remote work solution in which, effective July 2020, contractor personnel performing services under this Task 
Authorization will work remotely using the Contractor provided laptops. 


The Parties acknowledge that implementation of a remote work model will necessarily impact the services, and agree 
that: 
e Contractor personnel covered by the remote work solution will be advised of the Remote Work Protocols; 
e Contractor will provide training to any Contractor personnel working remotely that covers the Remote Work 
Protocols; 


Contractor will be responsible for security incidents arising from the implementation of the agreed remote work solution 
to the extent caused by Contractor failure to comply with the Remote Work Protocols. For purposes of the agreed 
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remote work solution, Contractor will not be responsible for complying with any security requirements that differ or 
conflict with the Remote Work Protocols. 


orkstations: 

e Accenture will implement controls for all workstations/laptops on Accenture provided devices that are used in 
connection with service delivery/receipt incorporating the following: Encrypted hard drive; 

e Software agent that manages overall compliance of workstation and reports a minimum on a monthly basis to 
a central server: 

e Patching process to ensure workstations are current on all required patches; 

e Ability to prevent non-approved software from being installed (e.g., peer-to-peer software); 

e Antivirus with a minimum weekly scan; 

e Firewalls installed: 

e Data Loss Prevention tool; and 

e Web filtering. 


Access Control: 
The Parties will comply with the following controls for their respective infrastructure: 


e Enable two-factor authentication for their respective VPNs; 

e IRCC will promptly provide authentication credentials for Accenture personnel, including any additional 
requirements to support IRCC’s two-factor authentication; 

e Promptly deactivate authentication credentials where such credentials have not been used for a period of time 
(such period of non-use not to exceed six months); 

e Deactivate authentication credentials upon notification that access is no longer needed (e.g., employee 
termination, project reassignment, etc.) within two business days; and 

e Manage the access controls using the least privilege access protocols where applicable. 


Connectivity: 

e Where Accenture personnel connect to Accenture networks and infrastructure, Accenture is responsible for 
applying Accenture standard technical and organizational security controls to such Accenture-provided 
workstation/laptop and the Accenture environment. 

e Where Accenture personnel are using Accenture provided laptops and accessing the IRCC network, 
environments and systems, IRCC is responsible for applying IRCC’s standard technical and organizational 
security controls in respect of such network, environments and systems to the IRCC’s network and 
environments. 

e Accenture cannot confirm that the wireless network used by such Accenture personnel is protected with 
agreed upon security standards. 


IRCC Standards: 

To the extent reasonably possible, Contractor personnel working remotely will continue to abide by the applicable 
IRCC policies and standards in performing the Services. Such policies govern and control within the IRCC’s systems 
and environments. 


Name, Title and Signature of Individual Authorized 
to Sign on Behalf of Contractor 
signature 


Date: _January 20, 2021 


Pierre Dupont, Managing Director 


(type or print) 
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Signatures (Client) 


Name, Title and Signature of Technical Authority 


to Sign on Behalf of CIC 


Name, Title and Signature of CIC Procurement 
Representative to Sign on Behalf of CIC 


Name, Title and Signature of Contracting 
Authority to Sign on Behalf of Public Works and 
Government Services Canada 


sina chapelle, ie 


Date: 2021.01.19 


Date: jason $ 2400-0500" 


Digitally signed by 


Signature: Ha | | Hall, Stephanie 


e . Date: 2021.01.20 
pate’ Stephanie noo 
(03:TZ-05 00 


Digitally signed by: Holden, 


Cc ; l 4 l l Carole 
Date: 2021.01.20 14:44:10 - 


Signature: 05'00 


Date: 


You are requested to sell to her Majesty the Queen in Right of Canada, in accordance with the terms and 


conditions set out herein, referred to 


herein, or attached hereto, the services listed herein and in any attached sheets at the price set out there of. 
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TASK AUTHORIZATION FORM 


Commitment Number (PR): 152548 Financial Coding: 0500-0140-6762-54080- 
RE Et o 
Task Number: 7113956 Amendment Number: |003 

Tenis trans ements ES 
lances RE fc PR 


Amendment #003 is raised to add an additional milestone for Transformation Office Operation, extend the TA 
end date to April 30, 2021, and increase the value of the TA by $183,800.00 for services, plus $27,524.05 for 
applicable taxes, for a total increase of $211,324.05. 


Amendment #002 is raised to add additional milestones for Transformation Office Operation and increase the 
alue of the TA by $550,425.00 for services, plus $82,426.14 for applicable taxes, for a total increase of 
$632,851.14. 


Amendment #001 is raised to correct the basis of payment and reduce the total TA value by $632,851.14 taxes 
included. 


This Task authorization addresses two areas of work: 
1. Transformation Office Design and Operation 
2. Power Platform MVP for Chinook 


Description of the Project / Work Required —Transformation Office Design and Operation 
BACKGROUND: 


IRCC has defined a bold transformation vision to become the world leader in migration. The pressures created by the 
COVID-19 pandemic have increased the urgency of accelerating key elements of this transformation. As IRCC 
mobilizes to undertake this ambitious enterprise wide digital transformation, a central body must be established to 
orchestrate the transformation. 


This central body — the transformation office — will be responsible for governing and ensuring the success of a multi- 
million-dollar transformation program that is critical to the revitalization efforts for IRCC. In addition, the global 
pandemic laid bare our limitations and has further reinforced the urgency of making our operations fundamentally 
digital so that our immigration system is more nimble and resilient. For the Transformation Office to be effective, it must 
be designed and operated with the appropriate organizational structure, capabilities, and roles required to enable 
success. 


IRCC has begun work to define the Transformation Office scope and mandate. The engagement to design the 
transformation office will build on the work completed to date and refining to accelerate the mobilization of the 
transformation office. 


Establishing an effective Transformation Office with the right capabilities must be staffed with employees with the right 
skillsets and practical experience to operate it effectively. Accenture can support by providing contracted resources 

ith the right experience and skillsets to not only help operate the Transformation Office in the short term but also to 
help coach and upskill IRCC employees to support an evolution to a fully staffed Transformation Office with mature 
capabilities to manage the transformation efforts. 


TASKS 
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For the Transformation Office Design, the Contractor will: 


= Review and refine existing inputs from IRCC Transformation Office design to analyze organizational structure 
options (e.g., centralized vs. decentralized) and recommend the selection of the appropriate model 

a= Review and refine key roles and skillsets required to support the Transformation Office 

= Review and refine the core capabilities within the Transformation Office 

= Leverage existing documentation to refine structures and processes underpinning the capabilities (e.g., 
delivery governance, benefits reporting) 

= Review and refine the activities and flow of inputs and action between the Transformation Office and key 
partners within IRCC (e.g., strategic policy & planning, DPM, ePMO, Technology) and outside IRCC (e.g., 
SSC, CBSA, IRB) 

= Define evolution stages to achieve the target state Transformation Office Build Program delivery roadmap 

= Outline how the Transformation Office should evolve as the transformation progresses and matures 

= Stand up key capabilities within the Transformation Office leveraging Accenture resources 

= Develop the supporting templates and tools to enable activation of core capabilities 

= Support definition and activation of Digital Journeys with industry and technology expertise 


A high-level timeline of the design phase is provided in Figure 1 below. 


Figure 1 High Level Timeline 
DELIVERABLES 


For the design of the transformation office, the Contractor will provide the following deliverables: 


= Organizational structure (including roles and skillsets) 

= Capability model & scope of delivery 

= Interaction model between transformation office & IRCC 

= Transformation Office evolution stages 

= Mobilize the Transformation Office 

= Support the ongoing operation of the Transformation Office 


Deliverable Inspection and Acceptance: The Project Lead, on behalf of the Technical Authority, will inspect and 
accept the deliverables within 3 business days of submission from the Contractor. The Deliverable will be deemed 
accepted after two (2) weeks from the date all Deliverables were submitted to the Technical Authority. 


Description of the Project / Work Required — Power Platform MVP for Chinook: 


BACKGROUND: 
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As the Government of Canada returns to business in a new COVID reality and the volume of Temporary Resident Visa 
applications increases, the IRCC needs to act quickly to automate a currently manual part of the process for 
Temporary Resident Visas by developing and implementing a replacement solution for the current Chinook Application. 


Global Case Management System (GCMS) is the core application at IRCC to process applications. Due to limitations 
of GCMS around performance and user interface, overseas processing centers started building local applications to 
manage workload. Chinook was launched to replace these local applications and consolidate them into single solution. 
Chinook is an Excel based application that consists of 6 modules namely 1) File Management, 2) Pre-Assessment, 3) 
Decision Maker, 4) Post-Decision, 5) Indicator Management and 6) Quality Assurance. The existing Chinook solution 
has issues around stability and scaling additional features. With the return to business in the current COVID reality and 
associated increases in volume, these issues have become more exasperated so that the IRCC now is looking for a 
replacement that can be rolled out in a rapid timeframe. 


Module 3, which is the ‘Decision Maker Module’ is in scope for the Power Platform MVP along with capabilities within 
Modules 4 and 5 that are incorporated in Module 3. The majority of visa processing offices in Canada and overseas 
use Chinook, and it is estimated that approximately 1,000 users (500 overseas and 500 in Canada) will use the 
replacement solution as part of this MVP. Power Platform was evaluated and is being considered as a replacement to 
Chinook. One of the key objectives of this MVP is to validate Power Platform as a solution, that can meet the IRCC’s 
requirements which are currently served by Chinook. 


TASKS 


For the Power Platform MVP for IRCC’s Chinook replacement, the Contractor will: 


e Provide support to the Technical Authority's infrastructure team to setup the Development and Production 
instances of Dynamics 365 CE (D365). These instances will be provisioned on the Technical Authority’s 
Azure tenant and will be federated with the tenant’s Azure Active Directory (AAD) to enable the user 
authentication. 

e Following agile approaches to development, the contractor will build MVP core functionality as defined in 
Sprint Planning sessions and based on prioritizations of user stories by the IRCC Journey Owner. The initial 
vision for the MVP roadmap is outlined below. The requirements outlined are provided as a high-level 
roadmap of the user stories and do not constitute a statement of full specifications to be developed in this 
release. It is expected and anticipated that user stories will be added or removed throughout the agile 
process. Services will be performed subject to available capacity as indicated in the staffing below 


O 


Undertake core platform configurations pertaining to workflow, business unit hierarchy, teams, user 
setup, and setup of the D365 role security model which provide the basis for further development. 
Enable the D365 language pack to support the English and French interface on the platform. French 
translations of custom components (entities, fields, labels, headers) will be provided by Technical 
Authority which will be imported into the platform by the Contractor. 

Build integration components to consume the GCMS extract (fixed format csv extracts). These 
extracts will be generated at a predefined location by the Technical Authority that is accessible by 
the cloud service. No integration will be built to push the decision data back into GCMS and the 
decisions will be manually copied into GCMS by the application user. 

Undertake upload of existing master tables and configuration tables in D365 using the cleansed 
data provided by Technical Authority in a predefined format (Excel or in a staging data). These 
tables will be used at various places in the application form as masters. 

Configure out-of-the-box search capability of D365 for users to be able to search for specific 
application forms filtering on predefined search attribute (application id). 

Build the user interface (Ul) using D365 forms for viewing the application and associated data. This 
will be the primary UI for users to view the application data. Besides the individual UI forms, D365 
views will be configured to view the application data in bulk. 

Build the mechanism to capture decisions and action notes on Temporary Resident applications. 
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Four templates will be configured to capture the application decisions in a structured manner. 
o Configure two end user dashboards (out-of-the-box configurations) that provide a snapshot and list 
view of applications and application status. 
o Build custom rules to surface indicator flags on the application that match the criteria (up to 25 
criteria in total). The rules will be triggered on the data that is already ingested by D365 as part of 
the original data upload. 
e Provide Systems Integration Testing (SIT) and User Acceptance Testing (UAT) support for a one-week period 
(combined). 
e Provide hypercare support post MVP rollout for a 2-week period. 
e Develop a potential application operations support approach, model, and plan for Power Platform. 


A high-level timeline is provided in Figure 2 below. 


Figure 2 High Level Timeline 


The following activities are Out of Scope for the Power Platform MVP and not included in the tasks to be completed by 
the Contractor. 


e Development of a mobile application and/or modifying legacy applications. 

e Power BI reporting for which estimates can be provided for a subsequent release, if requested. 

e Integration with GCMS. 

e Data cleansing and historical data migration. 

e Performance, penetration and load testing. Any mitigation on performance issues is not included and it is 
assumed that the native performance of the CRM application is sufficient. 

e Integration with any third-party authentication provider for user authentication/authorization. 

e Change management activities including the development of communication strategies and plans for the 
application launch. 

e Security testing and/or certification of the Technical Authority’s application. 

e Warranty and ongoing support beyond the Hypercare period. 

e Functional workshops for process re-engineering. 

e Modifications/extensions beyond the out-of-the-box language pack capability. French Language translations 
for all custom entities and attributes of the application including portals, screens, forms and training materials 
which will be provided by the Technical Authority. 

e Pre assessment notes (Module 2 of Chinook) are not included as part of this MVP build and these 
enhancements/extensions may be included in subsequent releases. 


DELIVERABLES 
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For the Power Platform MVP for IRCC’s Chinook replacement, the Contractor will provide the following six 
deliverables: 


High-level implementation plan for the MVP build. The implementation plan will be modified based on the 
outcomes of the ‘Plan and Design 2’ phase of the project. The implementation plan is a high-level roadmap of 
the potential future releases and is a 2-3 slide deck. 

High-Level product and integration requirements backlog — This backlog will cover the user stories that 
will be delivered in sprints. The user stories will be refined and updated in the ‘Plan and Design 1’ phase and 
then prioritized in ‘Plan and Design 2’, with clear acceptance criteria included with each user story, to confirm 
the application build scope. 

One-time data migration for master data. Cleansed master data provided by the Technical Authority in a 
pre-defined format will be uploaded in D365. 

Data upload component — Six csv-based Enterprise Data Warehouse (EDW) extracts (provided by the 
Technical Authority on a shared location accessible by the cloud service) will be ingested into D365. 
High-level solution architecture document of the build covering Technical Authority specific configurations 
and customizations. 

Potential approach, model and plan for application operations support for Power Platform 


Deliverable Inspection and Acceptance: The Project Lead, on behalf of the Technical Authority, will inspect and 
accept the deliverables within 3 business days of submission from the Contractor. The Deliverable will be deemed 
accepted after two (2) weeks from the date all Deliverables were submitted to the Technical Authority. 


Roles and Responsibilities Contractor Technical 
Authority 


SE 
Cros anagemen RAR 
EE VS LE 
[untTexingandagF® A 


CE CS TE 
TS CS EYES 


R: Responsible — Responsible for the performance of the work 

A: Accountable — Ultimately responsible for activity; includes Yes/No authority 
C: Consulted — Provides guidance and support 

|: Informed — Must be informed of actions, progress and decisions. 
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3. Work Location: N/A — All work to be conducted remotely. 

4. Invoice sent to: IRCC.DSBFINANCEADMIN-DGSNFINANCEADMIN.IRCC@cic.gc.ca 
[send copy of invoice to: carole.holden@tpsgc-pwgsc.gc.cal 

5. Travel Requirements: N/A — All work to be conducted remotely. 


6. Language Requirements: English. 


8. Level of Security Clearance Reliability Status. 
Required for the Contractor 
Personnel: 


9. Contractor’s Response: 
9.1 Milestone Payment Schedule 


| Payment Milestone | Week | Firm Price Amount (Taxes Extra) 


4. Transformation Office 
Capability Model and Delivery 
Scope 

5. Transformation Office Evolution Week 8 of Transformation Office 
Stages Design and Operation 


9.2 Total Cost 
Cost Breakdown: 


Week 4 of Transformation Office 
Design and Operation 


A.1 Application/ Software Architect 
— Level 3 


1.11 Technology Architect — Level 2 


A.11 Tester — Level 1 


A.6 Programmer/ Software 
Developer — Level 1 
A.6 Programmer/ Software 
Developer — Level 2 


P.8 Project Leader — Level 3 
B.3 Business Consultant — Level 2 


B.3 Business Consultant - Level 2 


P.1 Change Management 
Consultant - Level 1 


B.3 Business Consultant - Level 1 
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P.8 Project Leader - Level 3 
P.5 Project Executive - Level 3 


B.3 Business Consultant - Level 1 


Amendment #001 


P.1 Change Management 
Consultant - Level 1 


P.8 Project Leader - Level 3 


P.5 Project Executive - Level 3 
P.8 Project Leader - Level 2 
P.8 Project Leader - Level 2 


B.3 Business Consultant - Level 2 
B.3 Business Consultant - Level 1 


B.3 Business Consultant - Level 1 IBG IBG 


Amendment #002 
P.1 Change Management 
Consultant - Level 1 
P.8 Project Leader - Level 3 
P.5 Project Executive - Level 3 


P.8 Project Leader - Level 2 


P.8 Project Leader - Level 2 


FE Proca Leader Levez 


P.1 Change Management 
Consultant - Level 1 


Sub-Total of TA (Taxes Extra) (A): $1,570,825.00 


RE Applicable Taxes (B): $235,231.04 


A +B): panera 


9.3 Key Contract Assumptions and Dependencies: 


Assumptions 
e The Applicable Basis of Payment is a Firm TA Price for the tasks and deliverables identified in Section 1 
e The Applicable Method of Payment is milestone payments for the milestones outlined in Section 9.1 


e The Technical Authority will be responsible for the development of interfaces from and to existing IRCC 
systems. 
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e Contractor personnel will not have access to the IRCC production environment and production data, including 
but not limited to Personal Identifiable Information (PII) data. Any communication with Contractor will require 
the Technical Authority to ensure that no production or PII data is present. 

e The Technical Authority will be responsible for deploying the Chinook application into the production 
environment and subsequently will be responsible for the operations, support, and maintenance. 

e Contractor personnel will not be part of the production operations and maintenance support for the production 
environment. 

e The project will be executed remotely with all working sessions, meetings, and workshops to be conducted 
virtually. Further details are provided in Appendix 1 (“Remote Work Protocols”). 

e The Technical Authority will be responsible for the training and change management that is required as part of 
new and changed business processes. 

e The Technical Authority will be responsible for all infrastructure and environments and the associated costs, 
including the Microsoft Azure environments. 

e The Technical Authority will be responsible for timely participation of IRCC technology and business 
stakeholders in planned working sessions, workshops, interviews, meetings, and demos throughout the 
project. 

e The Technical Authority will be responsible for IRCC technology and business executive stakeholder 
availability for timely decision-making throughout the project. 

e The Contractor and/or IRCC may propose a change to the scope, terms or conditions of this Task 
Authorization and such change shall only be effective when it is set forth in a writing executed by authorized 
representatives of all Parties (“TA Amendment’). Once approved, such a change will be deemed to 
supplement or modify, as applicable, the terms and conditions of this TA to which it pertains. 


The following additional scope specific assumptions and dependencies are included for the Transformation Office 
Design and Operation are provided below: 


e Appropriate IRCC business stakeholders are available for day-to-day collaboration throughout the design and 
operation of the Transformation Office, including subject matter experts for the projects branch and IT 
operations. 

e Access to material from previous and current Transformation Office materials developed to date as an input to 
be reviewed and refined as part of the Transformation Office organizational design, delivery scope definition, 
and identification of interactions. 


The following additional scope specific assumptions and dependencies are included for the Power Platform MVP as 
provided below: 


e The native mechanism for user authentication will be leveraged that uses Azure Active Directory as identity 
provider. 

e EDW is the primary source of data for Chinook and is extracted from GCMS. EDW extracts (csv) will be 
manually moved by IRCC teams to file share on cloud. This file share is accessible by Cloud service (Power 
Automate, D365 online). 

° An integrated SIT environment will be provisioned by the IRCC’s infrastructure team to conduct the test run. 

° Native encryption technology provided by Dynamics 365 will be leveraged to encrypt data at rest and during 
transit between user devices and data centers. 

° Out-of-the-box audit will be enabled to track changes made by users on the application data. 

e The Dynamics 365 unified interface (versus mobile applications) will be used by all users of the Power Platform 
MVP. 

e Language translations will be provided by the Technical Authority before start of Sprint 3, if required 

e The offline capability offered out-of-the-box by the platform is sufficient to meet the requirements of low 
bandwidth areas. 

e The Technical Authority will work together with Contractor to create and provision the pre-production 
environment according to the agreed upon release plan and timelines. The Technical Authority will provide full 
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access to the DEV environment, suitable access to the TEST environment to enable Contractor resources to 
perform testing, troubleshooting and deployments. 

The Technical Authority is responsible for deployments to non-development environments and will make 
available deployment resources with adequate skills and availability that can successfully follow deployment 
instructions and ensure releases are deployed within the timeframes required. The Contractor's team can assist 
Technical Authority in building the deployment processes. 

The Technical Authority will procure licenses for the 3rd party applications, including licensing to enable the 
deployment of each 3rd party application in each CRM environment (DEV, TEST, etc.). 

The Technical Authority will be responsible for troubleshooting any firewalls, infrastructure / network security; 
and related IT hurdles that may arise. 

The Technical Authority will provide production quality test data for the user stories in the upcoming sprint. Test 
data will be provided in a format specified by the Contractor. Test data will be obfuscated by the client. 

The Technical Authority will provide production quality test data prior to the test phase. Test data will be provided 
in a format specified by the Contractor. 

The Contractor will provide one developer for two weeks past the MVP release to handle incidents and bugs (i.e. 
tier 3 support) for the application. 


Dependencies: 


Security certification of the Power Platform and the on-premise to online data gateway setup (associated with 
Protected B guidelines, gateway hardening and connectivity through SIGNET) to be completed by Microsoft, 
IRCC’s security team and IRCC’s technology operations team prior to the pilot rollout. 

Connectivity with the Power Platform for overseas offices who use a GAC system via Signet to be provisioned 
by Microsoft, IRCC’s Security team and IRCC’s technology operations team in order to allow the application to 
be accessed in overseas offices prior to the pilot rollout. 

The key roles of Project Manager, Product Owner, Functional SME and Technical SME to be identified and 
assigned by the Technical Authority prior to the start of the project with sufficient capacity to support the Power 
Platform MVP project. 

All available, relevant documentation, including high-level business process diagrams, and user story backlog to 
be provided by the Technical Authority prior to the start of the project. 

Environment provisioning to be completed prior to the start of the project by IRCC’s infrastructure, security, and 
technology operations teams. 

Environment access and domain credentials for the Contractor team members to be provided by IRCC’s 
infrastructure, security, and technology operations teams within two days of project start-up including access to 
following applications: 


® Backlog management tool for the project (Azure DevOps Boards, Jira); 

e Development tools (Visual Studio, Code Repository); 

® D365 development instance; 

e Power automate environment with relevant access to create new flows: 

° Access to EDW Extracts on the shared folder (or the location from where it is to be consumed); 
and 

è Configuration/Master Data for upload. 


Production deployment and rollout to be led by the IRCC infrastructure and technology operations teams, with 
support and guidance from the Contractor on setting up the deployment processes. The Contractor SME will 
lead the discussions as required bridging the knowledge gap from Power Platform perspective. 

The IRCC technology operations team, IRCC Technical SME and IRCC Functional SME to store EDW extracts 
on file share that is accessible by the cloud service (6 csv files) in week 1 of the project. For purposes of the 
MVP, the csv extracts from EDW must be manually moved to a file share location that is accessible by the cloud 
service (Power Automate, D365). 


Appendix 1 
Remote Work Protocols 
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This Appendix 1 sets out the remote work protocols to be followed by the Parties. In response to employee health and 
safety concerns related to the COVID-19 outbreak, the Parties have agreed that the Contractor will implement a 
remote work solution in which, effective July 2020, contractor personnel performing services under this Task 
Authorization will work remotely using the Contractor provided laptops. 


The Parties acknowledge that implementation of a remote work model will necessarily impact the services, and agree 
that: 
e Contractor personnel covered by the remote work solution will be advised of the Remote Work Protocols; 
e Contractor will provide training to any Contractor personnel working remotely that covers the Remote Work 
Protocols; 


Contractor will be responsible for security incidents arising from the implementation of the agreed remote work solution 
to the extent caused by Contractor failure to comply with the Remote Work Protocols. For purposes of the agreed 
remote work solution, Contractor will not be responsible for complying with any security requirements that differ or 
conflict with the Remote Work Protocols. 


orkstations: 

e Accenture will implement controls for all workstations/laptops on Accenture provided devices that are used in 
connection with service delivery/receipt incorporating the following: Encrypted hard drive; 

e Software agent that manages overall compliance of workstation and reports a minimum on a monthly basis to 
a central server: 

e Patching process to ensure workstations are current on all required patches; 

e Ability to prevent non-approved software from being installed (e.g., peer-to-peer software); 

e Antivirus with a minimum weekly scan; 

e Firewalls installed: 

e Data Loss Prevention tool; and 

e Web filtering. 


Access Control: 
The Parties will comply with the following controls for their respective infrastructure: 


e Enable two-factor authentication for their respective VPNs; 

e IRCC will promptly provide authentication credentials for Accenture personnel, including any additional 
requirements to support IRCC’s two-factor authentication; 

e Promptly deactivate authentication credentials where such credentials have not been used for a period of time 
(such period of non-use not to exceed six months); 

e Deactivate authentication credentials upon notification that access is no longer needed (e.g., employee 
termination, project reassignment, etc.) within two business days; and 

e Manage the access controls using the least privilege access protocols where applicable. 


Connectivity: 

e Where Accenture personnel connect to Accenture networks and infrastructure, Accenture is responsible for 
applying Accenture standard technical and organizational security controls to such Accenture-provided 
workstation/laptop and the Accenture environment. 

e Where Accenture personnel are using Accenture provided laptops and accessing the IRCC network, 
environments and systems, IRCC is responsible for applying IRCC’s standard technical and organizational 
security controls in respect of such network, environments and systems to the IRCC’s network and 
environments. 

e Accenture cannot confirm that the wireless network used by such Accenture personnel is protected with 
agreed upon security standards. 
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IRCC Standards: 

To the extent reasonably possible, Contractor personnel working remotely will continue to abide by the applicable 
IRCC policies and standards in performing the Services. Such policies govern and control within the IRCC’s systems 
and environments. 


Name, Title and Signature of Individual Authorized 
to Sign on Behalf of Contractor 
Signature:__ 


Date: “March 4 5021 


Pierre Dupont, Managing Director 


(type or print) 


Signatures (Client) 


Name, Title and Signature of Technical Authority 


Digitally signed by 


to Sign on Behalf of CIC a | 
LAC a D SSA chanelle te son 


__ Date: 2021.03.04 


6, Jason- 
Name, Title and Signature of CIC Procurement # 


Representative to Sign on Behalf of CIC Digitally signed by 


Strangemore, —_—<srangemore Jessica 


Date: 2021.03.04 12:23:34 


ES ar 


(type or print) 


Name, Title and Signature of Contracting Digitally signed by: Holden, 
i l i Carole 

Authority to Sign on Behalf of Public Works and | | Carole Holden E ERE aie: 

Government Services Canada Signature: 


Date: 


You are requested to sell to her Majesty the Queen in Right of Canada, in accordance with the terms and 


conditions set out herein, referred to 
herein, or attached hereto, the services listed herein and in any attached sheets at the price set out there of. 


Page110f11 
000022 


Immigration, Refugees Immigration, Réfugiés 
fi + il and Citizenship Canada et Citoyenneté Canada 
Information disclosed under the Access to Information Act 
L'information divulquée en vertu de la loi sur l'accès à l'information 


s.20(1)(b) 


TASK AUTHORIZATION FORM 


Commitment Number (PR#): 152548 Financial Coding: 0500-0140-6762-54080- 
RS ST o 

Task Number: 7113956 Amendment Number: 1004 
SC PS A 
EE PONS Lt acc PRE 


Amendment #004 is raised to add an additional milestone for Power Platform MVP for Chinook reflecting an 
additional and increase the value of the TA by $18,200.00 for services, plus $2,725.45 
for applicable taxes, for a total increase of $20,925.45. 


Amendment #003 is raised to add an additional milestone for Transformation Office Operation, extend the TA 
end date to April 30, 2021, and increase the value of the TA by $183,800.00 for services, plus $27,524.05 for 
applicable taxes, for a total increase of $211,324.05. 


Amendment #002 is raised to add additional milestones for Transformation Office Operation and increase the 
value of the TA by $550,425.00 for services, plus $82,426.14 for applicable taxes, for a total increase of 
$632,851.14. 


Amendment #001 is raised to correct the basis of payment and reduce the total TA value by $632,851.14 taxes 
included. 


This Task authorization addresses two areas of work: 
1. Transformation Office Design and Operation 
2. Power Platform MVP for Chinook 


Description of the Project / Work Required —Transformation Office Design and Operation 
BACKGROUND: 


IRCC has defined a bold transformation vision to become the world leader in migration. The pressures created by the 
COVID-19 pandemic have increased the urgency of accelerating key elements of this transformation. As IRCC 
mobilizes to undertake this ambitious enterprise wide digital transformation, a central body must be established to 
orchestrate the transformation. 


This central body — the transformation office — will be responsible for governing and ensuring the success of a multi- 
million-dollar transformation program that is critical to the revitalization efforts for IRCC. In addition, the global 
pandemic laid bare our limitations and has further reinforced the urgency of making our operations fundamentally 
digital so that our immigration system is more nimble and resilient. For the Transformation Office to be effective, it must 
be designed and operated with the appropriate organizational structure, capabilities, and roles required to enable 
SUCCESS. 


IRCC has begun work to define the Transformation Office scope and mandate. The engagement to design the 
transformation office will build on the work completed to date and refining to accelerate the mobilization of the 
transformation office. 


Establishing an effective Transformation Office with the right capabilities must be staffed with employees with the right 
skillsets and practical experience to operate it effectively. Accenture can support by providing contracted resources 
ith the right experience and skillsets to not only help operate the Transformation Office in the short term but also to 
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help coach and upskill IRCC employees to support an evolution to a fully staffed Transformation Office with mature 
capabilities to manage the transformation efforts. 


TASKS 


For the Transformation Office Design, the Contractor will: 


Review and refine existing inputs from IRCC Transformation Office design to analyze organizational structure 
options (e.g., centralized vs. decentralized) and recommend the selection of the appropriate model 
Review and refine key roles and skillsets required to support the Transformation Office 

Review and refine the core capabilities within the Transformation Office 

Leverage existing documentation to refine structures and processes underpinning the capabilities (e.g., 
delivery governance, benefits reporting) 

Review and refine the activities and flow of inputs and action between the Transformation Office and key 
partners within IRCC (e.g., strategic policy & planning, DPM, ePMO, Technology) and outside IRCC (e.g., 
SSC, CBSA, IRB) 

Define evolution stages to achieve the target state Transformation Office Build Program delivery roadmap 
Outline how the Transformation Office should evolve as the transformation progresses and matures 
Stand up key capabilities within the Transformation Office leveraging Accenture resources 

Develop the supporting templates and tools to enable activation of core capabilities 

Support definition and activation of Digital Journeys with industry and technology expertise 


A high-level timeline of the design phase is provided in Figure 1 below. 


Figure 7 High Level Timeline 


DELIVERABLES 


For the design of the transformation office, the Contractor will provide the following deliverables: 


Organizational structure (including roles and skillsets) 
Capability model & scope of delivery 

Interaction model between transformation office & IRCC 
Transformation Office evolution stages 

Mobilize the Transformation Office 

Support the ongoing operation of the Transformation Office 


Deliverable Inspection and Acceptance: The Project Lead, on behalf of the Technical Authority, will inspect and 
accept the deliverables within 3 business days of submission from the Contractor. The Deliverable will be deemed 
accepted after two (2) weeks from the date all Deliverables were submitted to the Technical Authority. 


Description of the Project / Work Required — Power Platform MVP for Chinook: 
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BACKGROUND: 


As the Government of Canada returns to business in a new COVID reality and the volume of Temporary Resident Visa 
applications increases, the IRCC needs to act quickly to automate a currently manual part of the process for 
Temporary Resident Visas by developing and implementing a replacement solution for the current Chinook Application. 


Global Case Management System (GCMS) is the core application at IRCC to process applications. Due to limitations 
of GCMS around performance and user interface, overseas processing centers started building local applications to 
manage workload. Chinook was launched to replace these local applications and consolidate them into single solution. 
Chinook is an Excel based application that consists of 6 modules namely 1) File Management, 2) Pre-Assessment, 3) 
Decision Maker, 4) Post-Decision, 5) Indicator Management and 6) Quality Assurance. The existing Chinook solution 
has issues around stability and scaling additional features. With the return to business in the current COVID reality and 
associated increases in volume, these issues have become more exasperated so that the IRCC now is looking for a 
replacement that can be rolled out in a rapid timeframe. 


Module 3, which is the ‘Decision Maker Module’ is in scope for the Power Platform MVP along with capabilities within 
Modules 4 and 5 that are incorporated in Module 3. The majority of visa processing offices in Canada and overseas 
use Chinook, and it is estimated that approximately 1,000 users (500 overseas and 500 in Canada) will use the 
replacement solution as part of this MVP. Power Platform was evaluated and is being considered as a replacement to 
Chinook. One of the key objectives of this MVP is to validate Power Platform as a solution, that can meet the IRCC’s 
requirements which are currently served by Chinook. 


TASKS 
For the Power Platform MVP for IRCC’s Chinook replacement, the Contractor will: 


e Provide support to the Technical Authority’s infrastructure team to setup the Development and Production 
instances of Dynamics 365 CE (D365). These instances will be provisioned on the Technical Authority’s 
Azure tenant and will be federated with the tenant’s Azure Active Directory (AAD) to enable the user 
authentication. 

e Following agile approaches to development, the contractor will build MVP core functionality as defined in 
Sprint Planning sessions and based on prioritizations of user stories by the IRCC Journey Owner. The initial 
vision for the MVP roadmap is outlined below. The requirements outlined are provided as a high-level 
roadmap of the user stories and do not constitute a statement of full specifications to be developed in this 
release. It is expected and anticipated that user stories will be added or removed throughout the agile 
process. Services will be performed subject to available capacity as indicated in the staffing below 

o Undertake core platform configurations pertaining to workflow, business unit hierarchy, teams, user 
setup, and setup of the D365 role security model which provide the basis for further development. 

o Enable the D365 language pack to support the English and French interface on the platform. French 
translations of custom components (entities, fields, labels, headers) will be provided by Technical 
Authority which will be imported into the platform by the Contractor. 

o Build integration components to consume the GCMS extract (fixed format csv extracts). These 
extracts will be generated at a predefined location by the Technical Authority that is accessible by 
the cloud service. No integration will be built to push the decision data back into GCMS and the 
decisions will be manually copied into GCMS by the application user. 

o Undertake upload of existing master tables and configuration tables in D365 using the cleansed 
data provided by Technical Authority in a predefined format (Excel or in a staging data). These 
tables will be used at various places in the application form as masters. 

o Configure out-of-the-box search capability of D365 for users to be able to search for specific 
application forms filtering on predefined search attribute (application id). 

o Build the user interface (UI) using D365 forms for viewing the application and associated data. This 
will be the primary UI for users to view the application data. Besides the individual UI forms, D365 
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views will be configured to view the application data in bulk. 

o Build the mechanism to capture decisions and action notes on Temporary Resident applications. 
Four templates will be configured to capture the application decisions in a structured manner. 

o Configure two end user dashboards (out-of-the-box configurations) that provide a snapshot and list 
view of applications and application status. 

o Build custom rules to surface indicator flags on the application that match the criteria (up to 25 
criteria in total). The rules will be triggered on the data that is already ingested by D365 as part of 
the original data upload. 

e Provide Systems Integration Testing (SIT) and User Acceptance Testing (UAT) support for a one-week period 
(combined). 

e Provide hypercare support post MVP rollout for a 2-week period. 

e Develop a potential application operations support approach, model, and plan for Power Platform. 

e Provide services to harden the solution for production readiness including implementing localization plug-in, 
providing additional knowledge transfer, providing best practices for test management 

e Provide hypercare support for a 3-week period from March 22% to April 9th, 2021 


À high-level timeline is provided in Figure 2 below. 


Figure 2 High Level Timeline 


The following activities are Out of Scope for the Power Platform MVP and not included in the tasks to be completed by 
the Contractor. 


e Development of a mobile applicationand/or modifying legacy applications. 

e Power BI reporting for which estimates can be provided for a subsequent release, if requested. 

e Integration with GCMS. 

e Data cleansing and historical data migration. 

e Performance, penetration and load testing. Any mitigation on performance issues is not included and it is 
assumed that the native performance of the CRM application is sufficient. 

e Integration with any third-party authentication provider for user authentication/authorization. 

e Change management activities including the development of communication strategies and plans for the 
application launch. 

e Security testing and/or certification of the Technical Authority's application. 

e Warranty and ongoing support beyond the Hypercare period. 

e Functional workshops for process re-engineering. 

e Modifications/extensions beyond the out-of-the-box language pack capability. French Language translations 
for all custom entities and attributes of the application including portals, screens, forms and training materials 
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which will be provided by the Technical Authority. 
e Pre assessment notes (Module 2 of Chinook) are not included as part of this MVP build and these 
enhancements/extensions may be included in subsequent releases. 


DELIVERABLES 


For the Power Platform MVP for IRCC’s Chinook replacement, the Contractor will provide the following six 
deliverables: 


e High-level implementation plan for the MVP build. The implementation plan will be modified based on the 
outcomes of the ‘Plan and Design 2’ phase of the project. The implementation plan is a high-level roadmap of 
the potential future releases and is a 2-3 slide deck. 

e High-Level product and integration requirements backlog — This backlog will cover the user stories that 
will be delivered in sprints. The user stories will be refined and updated in the ‘Plan and Design 1’ phase and 
then prioritized in ‘Plan and Design 2’, with clear acceptance criteria included with each user story, to confirm 
the application build scope. 

e One-time data migration for master data. Cleansed master data provided by the Technical Authority in a 
pre-defined format will be uploaded in D365. 

e Data upload component — Six csv-based Enterprise Data Warehouse (EDW) extracts (provided by the 
Technical Authority on a shared location accessible by the cloud service) will be ingested into D365. 

e High-level solution architecture document of the build covering Technical Authority specific configurations 
and customizations. 

e Potential approach, model and plan for application operations support for Power Platform 


Deliverable Inspection and Acceptance: The Project Lead, on behalf of the Technical Authority, will inspect and 
accept the deliverables within 3 business days of submission from the Contractor. The Deliverable will be deemed 
accepted after two (2) weeks from the date all Deliverables were submitted to the Technical Authority. 


Roles and Responsibilities Contractor Technical 
Authority 


Devsionmen,Testand reaicon Enuronmentseup i [ra 
Poean RAR 
Ee T S SS 
C T S 


uw Preparatonara eean ho o ETS 
Temra eoc Tannera h ha 
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R: Responsible — Responsible for the performance of the work 

A: Accountable — Ultimately responsible for activity; includes Yes/No authority 
C: Consulted — Provides guidance and support 

|: Informed — Must be informed of actions, progress and decisions. 


3. Work Location: N/A — All work to be conducted remotely. 


4. Invoice sent to: IRCC.DSBFINANCEADMIN-DGSNFINANCEADMIN.IRCC@cic.gc.ca 
[send copy of invoice to: carole.holden@tpsgc-pwgsc.gc.ca] 


5. Travel Requirements: N/A — All work to be conducted remotely. 


6. Language Requirements: English. 
7. Other Conditions / Constraints: 


8. Level of Security Clearance Reliability Status. 
Required for the Contractor 
Personnel: 


9. Contractor’s Response: 
9.1 Milestone Payment Schedule 


Payment Milestone | Week | Firm Price Amount (Taxes Extra) 


4. Transformation Office | | 
Capability Model and Delivery Week 4 of Transformation Office 


Scope Design and Operation 


5. Transformation Office Evolution Week 8 of Transformation Office 
Stages Design and Operation 


10. Chinook Hypercare Extension March 31, 2021 


9.2 Total Cost 
Cost Breakdown: 
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A.1 Application/ Software Architect 
— Level 3 


B.3 Business Consultant - Level 1 TBC 
Amendment #001 | 
P.1 Change Management 
Consultant - Level 1 


B.3 Business Consultant - Level 2 
B.3 Business Consultant - Level 1 


Amendment #002 | 
P.1 Change Management 
Consultant - Level 1 
P.8 Project Leader - Level 3 
P.5 Project Executive - Level 3 


Amendment #003 | 
P.1 Change Management 
Consultant - Level 1 
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P.8 Project Leader - Level 3 
B.3 Business Consultant - Level 1 
B.3 Business Consultant - Level 1 
B.3 Business Consultant - Level 2 
B.3 Business Consultant - Level 1 


Amendment #004 


A.6 Programmer/ Software 
Developer — Level 2 


po) Sub-Total of TA (Taxes Extra) (A): $1,589,025 
ny nen! Applicable Taxes (B): $237,956.49 


A+B): 


9.3 Key Contract Assumptions and Dependencies: 


Assumptions 

e The Applicable Basis of Payment is a Firm TA Price for the tasks and deliverables identified in Section 1 

e The Applicable Method of Payment is milestone payments for the milestones outlined in Section 9.1 

e The Technical Authority will be responsible for the development of interfaces from and to existing IRCC 
systems. 

e Contractor personnel will not have access to the IRCC production environment and production data, including 
but not limited to Personal Identifiable Information (PII) data. Any communication with Contractor will require 
the Technical Authority to ensure that no production or PII data is present. 

e The Technical Authority will be responsible for deploying the Chinook application into the production 
environment and subsequently will be responsible for the operations, support, and maintenance. 

e Contractor personnel will not be part of the production operations and maintenance support for the production 
environment. 

e The project will be executed remotely with all working sessions, meetings, and workshops to be conducted 
virtually. Further details are provided in Appendix 1 (“Remote Work Protocols”). 

e The Technical Authority will be responsible for the training and change management that is required as part of 
new and changed business processes. 

e The Technical Authority will be responsible for all infrastructure and environments and the associated costs, 
including the Microsoft Azure environments. 

e The Technical Authority will be responsible for timely participation of IRCC technology and business 
stakeholders in planned working sessions, workshops, interviews, meetings, and demos throughout the 
project. 

e The Technical Authority will be responsible for IRCC technology and business executive stakeholder 
availability for timely decision-making throughout the project. 

e The Contractor and/or IRCC may propose a change to the scope, terms or conditions of this Task 
Authorization and such change shall only be effective when it is set forth in a writing executed by authorized 
representatives of all Parties (“TA Amendment’). Once approved, such a change will be deemed to 
supplement or modify, as applicable, the terms and conditions of this TA to which it pertains. 


The following additional scope specific assumptions and dependencies are included for the Transformation Office 
Design and Operation are provided below: 


e Appropriate IRCC business stakeholders are available for day-to-day collaboration throughout the design and 
operation of the Transformation Office, including subject matter experts for the projects branch and IT 
operations. 

e Access to material from previous and current Transformation Office materials developed to date as an input to 
be reviewed and refined as part of the Transformation Office organizational design, delivery scope definition, 
and identification of interactions. 
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The following additional scope specific assumptions and dependencies are included for the Power Platform MVP as 
provided below: 


The native mechanism for user authentication will be leveraged that uses Azure Active Directory as identity 
provider. 

EDW is the primary source of data for Chinook and is extracted from GCMS. EDW extracts (csv) will be 
manually moved by IRCC teams to file share on cloud. This file share is accessible by Cloud service (Power 
Automate, D365 online). 

An integrated SIT environment will be provisioned by the IRCC’s infrastructure team to conduct the test run. 
Native encryption technology provided by Dynamics 365 will be leveraged to encrypt data at rest and during 
transit between user devices and data centers. 

Out-of-the-box audit will be enabled to track changes made by users on the application data. 

The Dynamics 365 unified interface (versus mobile applications) will be used by all users of the Power Platform 
MVP. 

Language translations will be provided by the Technical Authority before start of Sprint 3, if required 

The offline capability offered out-of-the-box by the platform is sufficient to meet the requirements of low 
bandwidth areas. 

The Technical Authority will work together with Contractor to create and provision the pre-production 
environment according to the agreed upon release plan and timelines. The Technical Authority will provide full 
access to the DEV environment, suitable access to the TEST environment to enable Contractor resources to 
perform testing, troubleshooting and deployments. 

The Technical Authority is responsible for deployments to non-development environments and will make 
available deployment resources with adequate skills and availability that can successfully follow deployment 
instructions and ensure releases are deployed within the timeframes required. The Contractor's team can assist 
Technical Authority in building the deployment processes. 

The Technical Authority will procure licenses for the 3rd party applications, including licensing to enable the 
deployment of each 3rd party application in each CRM environment (DEV, TEST, etc.). 

The Technical Authority will be responsible for troubleshooting any firewalls, infrastructure / network security; 
and related IT hurdles that may arise. 

The Technical Authority will provide production quality test data for the user stories in the upcoming sprint. Test 
data will be provided in a format specified by the Contractor. Test data will be obfuscated by the client. 

The Technical Authority will provide production quality test data prior to the test phase. Test data will be provided 
in a format specified by the Contractor. 

The Contractor will provide one developer for two weeks past the MVP release to handle incidents and bugs (i.e. 
tier 3 support) for the application. 


Dependencies: 


Security certification of the Power Platform and the on-premise to online data gateway setup (associated with 
Protected B guidelines, gateway hardening and connectivity through SIGNET) to be completed by Microsoft, 
IRCC’s security team and IRCC’s technology operations team prior to the pilot rollout. 

Connectivity with the Power Platform for overseas offices who use a GAC system via Signet to be provisioned 
by Microsoft, IRCC’s Security team and IRCC’s technology operations team in order to allow the application to 
be accessed in overseas offices prior to the pilot rollout. 

The key roles of Project Manager, Product Owner, Functional SME and Technical SME to be identified and 
assigned by the Technical Authority prior to the start of the project with sufficient capacity to support the Power 
Platform MVP project. 

All available, relevant documentation, including high-level business process diagrams, and user story backlog to 
be provided by the Technical Authority prior to the start of the project. 

Environment provisioning to be completed prior to the start of the project by IRCC’s infrastructure, security, and 
technology operations teams. 

Environment access and domain credentials for the Contractor team members to be provided by IRCC’s 
infrastructure, security, and technology operations teams within two days of project start-up including access to 
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following applications: 


e Backlog management tool for the project (Azure DevOps Boards, Jira); 

e Development tools (Visual Studio, Code Repository); 

e D365 development instance; 

e Power automate environment with relevant access to create new flows; 

° Access to EDW Extracts on the shared folder (or the location from where it is to be consumed); 
and 

e Configuration/Master Data for upload. 


° Production deployment and rollout to be led by the IRCC infrastructure and technology operations teams, with 
support and guidance from the Contractor on setting up the deployment processes. The Contractor SME will 
lead the discussions as required bridging the knowledge gap from Power Platform perspective. 

e The IRCC technology operations team, IRCC Technical SME and IRCC Functional SME to store EDW extracts 
on file share that is accessible by the cloud service (6 csv files) in week 1 of the project. For purposes of the 
MVP, the csv extracts from EDW must be manually moved to a file share location that is accessible by the cloud 
service (Power Automate, D365). 


Appendix 1 
Remote Work Protocols 


This Appendix 1 sets out the remote work protocols to be followed by the Parties. In response to employee health and 
safety concerns related to the COVID-19 outbreak, the Parties have agreed that the Contractor will implement a 
remote work solution in which, effective July 2020, contractor personnel performing services under this Task 
Authorization will work remotely using the Contractor provided laptops. 


The Parties acknowledge that implementation of a remote work model will necessarily impact the services, and agree 
that: 
e Contractor personnel covered by the remote work solution will be advised of the Remote Work Protocols; 
e Contractor will provide training to any Contractor personnel working remotely that covers the Remote Work 
Protocols; 


Contractor will be responsible for security incidents arising from the implementation of the agreed remote work solution 
to the extent caused by Contractor failure to comply with the Remote Work Protocols. For purposes of the agreed 
remote work solution, Contractor will not be responsible for complying with any security requirements that differ or 
conflict with the Remote Work Protocols. 


orkstations: 

e Accenture will implement controls for all workstations/laptops on Accenture provided devices that are used in 
connection with service delivery/receipt incorporating the following: Encrypted hard drive; 

e Software agent that manages overall compliance of workstation and reports a minimum on a monthly basis to 
a central server: 

e Patching process to ensure workstations are current on all required patches; 

e Ability to prevent non-approved software from being installed (e.g., peer-to-peer software); 

e = Antivirus with a minimum weekly scan; 

e Firewalls installed: 

e Data Loss Prevention tool; and 

e Web filtering. 


Access Control: 
The Parties will comply with the following controls for their respective infrastructure: 
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Enable two-factor authentication for their respective VPNs; 

IRCC will promptly provide authentication credentials for Accenture personnel, including any additional 
requirements to support IRCC’s two-factor authentication; 

Promptly deactivate authentication credentials where such credentials have not been used for a period of time 
(such period of non-use not to exceed six months); 

Deactivate authentication credentials upon notification that access is no longer needed (e.g., employee 
termination, project reassignment, etc.) within two business days; and 

Manage the access controls using the least privilege access protocols where applicable. 


Connectivity: 

e Where Accenture personnel connect to Accenture networks and infrastructure, Accenture is responsible for 
applying Accenture standard technical and organizational security controls to such Accenture-provided 
workstation/laptop and the Accenture environment. 

Where Accenture personnel are using Accenture provided laptops and accessing the IRCC network, 
environments and systems, IRCC is responsible for applying IRCC’s standard technical and organizational 
security controls in respect of such network, environments and systems to the IRCC’s network and 
environments. 

Accenture cannot confirm that the wireless network used by such Accenture personnel is protected with 
agreed upon security standards. 


IRCC Standards: 

To the extent reasonably possible, Contractor personnel working remotely will continue to abide by the applicable 
IRCC policies and standards in performing the Services. Such policies govern and control within the IRCC’s systems 
and environments. 


Name, Title and Signature of Individual Authorized 
to Sign on Behalf of Contractor 
Signature: 


Pierre Dupont, Managing Director Date. March 24,'2021 


(type or print) 


Signatures (Client) 


Name, Title and Signature of Technical Authority 
to Sign on Behalf of CIC 


Signature: Digitally signed by 


tatauro, Concetta 
latauro, Concetta Dte: 2021.03.25 


Date: ____11:16:41-04 "00 


Name, Title and Signature of CIC Procurement 
Representative to Sign on Behalf of CIC Digitally signed by 
Signature: St ran g emo _ Strangemore, Jessica 


Date: Ye, Jessica 2206: 20710325 


Page 11 of 12 
000033 


Immigration, Refugees Immigration, Réfugiés 
i + il and Citizenship Canada et Citoyenneté Canada 
Information disclosed under the Access to Information Act 
L'information divulquée en vertu de la loi sur l'accès à l'information 


Name, Title and Signature of Contracting Digitally signed by: Holden, 
Authority to Sign on Behalf of Public Works and Carole Holden oe. en 
Government Services Canada Signature: an 


Date: 


You are requested to sell to her Majesty the Queen in Right of Canada, in accordance with the terms and 


conditions set out herein, referred to 
herein, or attached hereto, the services listed herein and in any attached sheets at the price set out there of. 
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AMENDMENT 1 


APPENDIX B TO ANNEX A TASK AUTHORIZATION FORM 


Commitment Number (PR#): 1152622 Financial Coding: 0500-0640-6762-54080- 
RE 75 
Task Number: 7114037 Amendment Number: 001 
Teeter acy | ES 
Et 


NEW 
Amendment #001 is raised to: 


e Amend the Description of the Project/Work required (highlighted in yellow) 

e Revise deliverables and their respective schedule 

e Increase the TA amount by $1,919,450 for services, plus $287,437.64 in applicable taxes for an 
overall increase of $2,206,887.64 


Task Authorization — Statement of Work 
GCMS DR Testing Capability 


Description of the Project / Work Required: 
Digital & System Integration Services - Emergency Response to COVID-19 


Immigration, Refugees and Citizenship Canada (IRCC) is seeking the services of a global 
organization(s) (the “Contractor’’) with expertise in rapidly developing and implementing Digital 
solutions and supporting technologies in response to the recent global pandemic. COVID-19 has 
increased the urgency for IRCC to develop updated (1) new strategies, and (11) processes and digital 
systems to cope with the rapid change it is undergoing. These include updating systems and processes 
for internal staff, re-thinking and re-designing how IRCC provides its services to its clients within 
Canada and around the world, leveraging digital processes wherever possible thus minimizing the 
need for in-person interaction or paper-based processes for the safety of IRCC’s staff, clients and 
community. 


Specifically for this TA, the focus is on the integral digital system of Global Case Mananagement 
System (GCMS) and supporting the GCMS Disaster Recovery (DR) project. This is a work is 
required to ensure integral GCMS processes and digital systems are maintained during COVID-19, a 
op priority for IRCC as it is a critical enabler of the Digital Platform Modernization (DPM) initiative 
which, in turn, is a top priority for the Government of Canada. 


The DR project is about to enter an intensive testing phase to validate that the application functions, as 
designed, on new infrastructure, in a new data center and that disaster recovery, performance, partner 
interfaces, and local failovers work as expected. 


To date, project testing has used a shared model leveraging existing resources and approaches from the 
existing application support and development teams. Resource contention and competing priorities have 
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led to delays in test execution and defect management. This has impacted the project schedule. The 
esting model needs to be changed to provide dedicated focus to testing and defect management. The 
project needs a robust testing and defect management capability that can reliably deliver a tested 
application in accordance with the project schedule. 


The project also requires refinement of the post-cutover operating model to ensure streamlined 
operations in production between all involved stakeholders. 


IRCC requires the respondent to create and manage a testing capability for the project that would take 

he project through to implementation. The respondent would review the project’ s current testing efforts 
and propose an approach to complete the project. This would be reviewed with the project authority 
and, upon agreement, proceed to implementation which will allow for the GCMS DR project to mee 
he identified QA and operational goals within the defined project timelines. 


Background 


The Global Case Management System (GCMS) is an Immigration, Refugees and Citizenship Canada 
(IRCC) mission-critical application utilized by more than 16,000 users from IRCC and various other 
government departments such as: Canada Border Services Agency (CBSA), Global Affairs Canada 
(GAC), Immigration and Refugee Board of Canada (IRB), Royal Canadian Mounted Police (RCMP), 
Employment and Social Development Canada (ESDC) and others. Unavailability of this service can 
lead to border closures and the inability to process travel visas and immigration requests. 
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During the summer of 2015, Gartner Inc., in conjunction with IRCC and SSC conducted a GCMS 
Disaster Recovery (DR) analysis and recommended the implementation of a DR site at one (1) of the 
new SSC managed Enterprise Data Centers (EDCs). 


The GCMS Disaster Recovery (GCMS DR) project involves a migrating the existing production and 
staging environments for the GCMS application from the JETS data center to EDC Barrie. The 
disaster recovery site for the GCMS will be the SSC Gatineau data center. 


The GCMS production environment is configured to operate in a high availability mode with most 
components supporting fail over to a duplicate component in the event of a single or multiple component 
failure. The client facing portion of the GCMS service hub is built on a two-(2) node concept (one active, 
one inactive) to facilitate the deployment of GCMS functionality with minimal downtime. All 
production components operate out of a single datacenter (Jean Edmonds Tower South (JETS)) in 
downtown Ottawa, there is no secondary datacenter or fail-over site currently in place. This presents a 
high risk to IRCC and other GCMS stakeholders given that a serious outage affecting the datacenter 
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could affect all IRCC services for an extended period of time. 


Currently, the project is being managed by a core IRCC/SSC team led by a pair of Directors — one 
from each department. The core team is focused on project management, architecture, design, and 
infrastructure provision. Other project tasks such as application builds, testing, defect fixes, and 
infrastructure are delivered via a sharing arrangement with IRCC’s IT-Operations and SSC’s Service 
lines. 


The project has completed design and development and is about to enter the testing phase. 
Current Testing Approach 


The project is currently completing the build of the Staging environments at EDC Barrie. Staging has 
2 environments — Staging A and Staging B and they are replicas of each other. They will be identical 
o the eventual Production A and B environments with the only difference being the capacity of the 
environments. The testing of these 4 environments represents the scope of this work. 


The same testing will be performed for each of the staging A/B and production A/B builds and it 
needs to verify: 


1. All GCMS functions perform as they do today in JETS on the new infrastructure, upgraded 
operating system, at EDC Barrie 


Partner connectivity functions as it does today 
GCMS has a sufficient level of performance 


New testing to confirm disaster recovery and failover testing between the A/B streams 


a+ oe AS 


Testing to verify new infrastructure reacts in the way expected in the event of local issues 


o new GCMS functionality is being delivered as part of the project. The focus is on moving the 
GCMS application suite from JETS to EDC Barrie, upgrading operating systems, installing the 
application on new infrastructure, and creating a disaster recovery ability at a sister data center. 


The current test planning approach is to execute the same suite of test cases in each of the 
environments (Staging A/B, Production A/B). To exercise all the GCMS functions and verify the 
esting criteria, requires ~500 test cases. This was based on an analysis by the project team and the IT- 
OPS team that supports GCMS today. These test cases were developed and scripted during test 
planning and consist of a mix of automated and manual test cases. The existing GCMS QA test team 
estimates that execution is ~ 1 test case per day. The current approach is to repeat the same suite of 
est cases in each of the 4 environments. 


The current approach has defects handled by the development teams and managed through a ticketing 
system. Four development teams handle the majority of the defects: 


- Siebel 

- eServices 

- Integration — Biztalk and a Message Exchange Layer based on MQ 
- ESO which handles the application builds. 
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Capacity and priority contention between defects and other development activities leads to slow defect 
resolution which delays the project’s testing efforts. This is a key problem for the project that needs to 
be addressed through this Statement of Work. The project is currently attempting to complete testing 
in development and integration environments both of which are on the SDLC path prior to Staging and 
Production. 


The QA team uses Selenium test suite for automation and Loadrunner for performance testing. 


REVISED Statement of Work and Deliverables 
Stream I (Advisory) Scope: 


To execute the Stream I work, the activities that IRCC expects would include: 


e Understanding the current situation. This involves reviewing the existing test plans, 
approach, environments, resourcing plans, defects, deployment and testing processes and 
governance, and progress for the project. This would also include interviewing members of the 
project management, key testing participants, and reviewing existing documents, including the 
proposed test scripts. 


e Developing a proposed approach to complete testing for the DR project. This approach 
would include: 


e Testing approach for testing planning, execution and defect fix. 


e Resourcing model to execute the approach including defect fixes including how the 
acquire the right knowledge to execute defect fixes 


e Approach to managing the testing process 
e Requirements and resourcing from IRCC/SSC to support this approach 


e Integration points and a proposed interaction model with the existing IRCC IT-Ops 
organization that support the GCMS application and release today. 


e Approach for code package promotion through the environment stack balancing out 
needs for speed and quality 


e Approach to reducing volume of operational work by ESO 
e A list of the proposed testing deliverables. 


e An estimate, timeline, and proposed cost to complete the work. 


e The risk and issues associated with the proposed approach 


model for testing and defect management (informed by key 
risks and issues), including approach on testing environments, 
tools and test data. 


000038 


Immigration, Refugees Immigration, Réfugiés 
fi + il and Citizenship Canada et Citoyenneté Canada 
Information disclosed under the Access to Information Act 
L'information divulquée en vertu de la loi sur l'accès à l'information 


Workplan, Estimates, Resourcing To implement and execute the proposed approach. The 
estimate should include the underlying assumptions such as # 
of test cases, time to execute test case, # of defects, etc. It 
needs to provide visibility into the staffing model so IRCC 


| projects current testing model to the proposed approach with 
minimal disruption to the project and schedule. 


Critical Success Factors _A list of the key assumptions and critical success factors that 
E _ | will make the proposed approach successful. 

Deliverable Schedule and A list and description of the key testing deliverables that the 
Description — — respondent would provide as they execute testing. — 

Summary Presentation A summary of the approach, workplan and estimates that can 


be used at the DG/ADM level 


In addition to the aforementioned requirements around DR testing scope, there is a need to align the 
various stakeholder on the operating model for Day 2, post migration cutover into the new data 
centres. The request for the contractor is to help derive alignment by coordinating with the various 
stakeholders on areas of alignment, facilitating discussions and document the outcomes of the 
conversations. 


EW Stream II (Implementation Support) Scope: 


As part of Stream II, the contractor will be engaged to execute on the prioritized recommendations 
from the assessment and build process optimization and automation in order to ensure DR project can 
be delivered in a timely manner in accordance with DR project timelines. 


The contractor is required to augment the DR delivery team, especially in areas where capacity and 
capability gaps exists, in particular to the following functions: performance testing, test automation, 
ESO operations work. 


The contractor will also be required to continue managing and coordinating the various stakeholders 
involved to drive the Day 2 operating model work to completion including initiating the thinking on 


ore cutover dry runs and failover testing approach. 


EW Work Details: 


The Director for the GCMS project is Franck Desormiere. The responsible senior executive is Nancy 
Violette-Fehr. 
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ROM 26th Jan, 2021 TO 11th Jun, 2021 = = 


a /A — All work to be con ucted remotely. 


4. Invoice sent to: IRCC.DSBFINANCEADMIN- 
DGSNFINANCEADMIN.IRCC(@cic.gc.ca 


[send copy of invoice to: carole.holden(@tpsgc-pwgsc.gc.ca | 


5. Travel Requirements: /A — All work to be conducted remotely. 


6. Language Requirements: English. 
7. Other Conditions / JA. 
Constraints: 


8. Level of Security Clearance [IReliability Status. 
Required for the Contractor 


Personnel: 


9. Contractor’s Response: 
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REVISED 9.1 Milestone/Deliverable and Services 


9.1.a Stream I Milestone/Deliverable 


This stream’s work is based on fixed cost by milestone as follows: 


1. Defect Management Optimization and Plans Week 4 
2. Code Promotion Approach 


1. Test Strategy 


2. Failover Test Execution and Coordination Plans 

3. Recommendations for Environment Support and 
Operations 

4. Day 2 Operating Model Outline and Early Draft 


NEW 9.1.b Stream II Milestone/Deliverable 


Milestone/Deliverabl 


Wee 


Prioritized Defect Management Recommendations 12-Mar-21 
Delivery 


Recommendations Delivery 


exclusive of tax) 


*As agreed upon with project leadership, in particular to staff augmentation function and otherwise 


Deliverable and Milestone Inspection and Acceptance: The Project Lead, on behalf of the 
Technical Authority, will inspect and accept the deliverables (as outlined in section 1) and milestones 
within 3 business days of submission from the Contractor, prior to payment processing. 


REVISED 9.2 Total Cost 
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9.2.a Cost breakdown for Stream I: 


Category and Name of Propose 


Level 3 P.5 - Project Executive - 
Level 3 P.5 - Project Executive - 
Level 3 P.5 - Project Executive - 
Level 2 P.9 — Project Manager - QA 
/ Testing Manager - 


Level 2 — B.3 — Business Consultant 
- QA/ Testing Sr Consultant — 


Level 2 P.9 — Project Manager - Ops 
Manager - 

Level 2 P.9 — Project Manager — Sr 
Deployment/ Release Process 
Engineer — 


Level 2 — B.3 — Business Consultant 
Project Facilitation / Deliverable 
Support - 

Level 2 — P.9 — Project Manager — 
Day 2 OpModel Lead - 


Team members supporting integration with other Deloitte projects. Marginal efforts included 
with no associated cost 
Level 3 P.5 - Project Executive - 


Level 1 B.3 — Business Consultant — 
Project Consultant - 
Level 3 PS - Project Executive — 


Level 3 P.5 - Project Executive — 


Fxtra) (A): $360,000.00 


fo l Applicable Taxes (B): | $53,910.00 
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| Total Cost of “-A Stream | (Taxes 


- This work will be delivered at a firm fixed price as per the milestone / deliverable payment 
| schedule above. The total fixed price $413,91820 is reflective of applicable taxes (based on a 
tax rate of 14.975%) 
- The cost breakdown provided is reflective of estimated effort and assumptions at the time of 
TA submission. Actual hours may vary from these estimates over the course of delivery, but 
will not impact the price to deliver the scope described for the Stream I in this TA 


EW 9.2.b Cost breakdown for Stream II: 


Level 3 P.5 - Project Executive - 
Level 3 P.5 - Project Executive - 
Level 3 P.5 - Project Executive - 
Level 3 P.5 - Project Executive - 
Level 3 P.9 — Project Manager - QA 
/ Testing Manager — 

Level 2 — P.9 — Project Manager — 
Delivery Enablement — 


Level 2 P.3 — Business Consultant — 
Delivery Enablement -TBC 
Level 2 P.9 — Project Manager — 
Testing — TBC 

Level 2 — A.6 — Programmer / 
Software Developer — TBC 
Level 2 — A.6 — Programmer / 
Software Developer — TBC 
Level 2 — A.6 — Programmer / 
Software Developer — TBC 
Level 2 — A.6 — Programmer / 
Software Developer — TBC 
Level 2 — I.9 — System 
Administrator - TBC 

Level 1 — A.1 — Application / 
Software Architect - TBC 

Level 3 P.9 — Project Manager — 
Day 2 OpModel — 
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Day 2 OpModel — TBC In Progress 
Consultant — Day 2 OpModel — TBC In Progress 
Level 3 P.5 - Project Executive - 


Level 1 B.3 — Business Consultant — 
Project Consultant - 


included) (C= A + B): 
Tota Cost of TA including Stream | 


- This Stream II work will be delivered at a firm fixed price as per the milestone / deliverable 
payment schedule above. The total price $2,206,887.64 is reflective of applicable taxes 
(based on a tax rate of 14.975%) 

- The cost breakdown provided is reflective of estimated effort and assumptions at the time of 
this TA submission. Number of resources and durations can be adjusted based on joint 
agreement between IRCC and Deloitte 


- Deloitte will submit engagement payment invoice to IRCC every four (4) weeks based on 
work performed on a time and material basis based on work actually performed on the 
project 


9.3 Key Contractor Assumptions and Dependencies 


REVISED Assumptions 


- The start date for the Stream I work will be December 23, 2020, and the end date will be 
February 5, 2021 


- The start date for the Stream II work will be January 26, 2021, and the end date will be June 
11, 2021 

- Activities and deliverables will be completed in collaboration with IRCC 

- IRCC will identify the stakeholders to attend any information sessions and meetings 

- IRCC will provide access to all required data and documents in a timely manner needed to 
complete the advisory stream (Stream I) of the engagement 

- IRCC will book interviews and ensure stakeholders provide necessary support for the 
engagement 

- Work will be conducted remotely via telephone and videoconferencing as appropriate 

- Deloitte and IRCC will confirm the deliverable sign-off process as part of the first week of 
work on this TA. This will include identifying who from IRCC will provide approval for each 
deliverable. 
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Deliverables and work products (1.e., presentation material, tools and templates) will be 
provided in English. Translation, if required, will be provided, in a timely manner, by IRCC. 
Implementation of improvement recommendations e.g. roll-out and operation of defect 
management process, implementation of the recommended environment management 
approach as well as staffing of incremental resources are out of scope of Stream I 

Depending on the security requirements, IRCC will provide a laptop and required access in a 
timely manner for the engagement 

Completion of the work within this TA will not preclude Deloitte from providing support to 
additional IRCC initiatives and priorities 

Open-source test automation framework e.g. Selenium will be leveraged to develop under 
Function B for Stream II 


REVISED Dependencies 


Stream I 

- Availability of IRCC personnel for key interviews and deliverable reviews across the following 
functions: development, testing, project management, ESO (operations) to establish the current 
state 
Availability of project documents aforementioned to establish current state. If necessary, the 
required information will be gathered through interviewing stakeholders or observing project 
activities 

Stream II 


- Socialization of the Deloitte Stream IT project mandate to project resources by IRCC leadership 
- Management support from project leadership (QM and ESO) 


Alignment on accountability and signing authority for Day 2 Op-Model deliverables 


Name, Title and Signature of Individual Authorized to 
Sign on Behalf of Contractor 


Shannon Kot ali 


Partner, Consulting Date: Jan 25, 2021 
(type or print) 


Signatures (Client) 


Name, Title and Signature of Technical Authority to 
Si Behalf of CIC M 
AP nee on Desormier r l e r Digitally signed by Desormiere, 
' A = == 
Franck LLL OUNLOAL F anck Date: 2021.01.25 08:33:54 -05'00' 
ater r LT 


(type or print) 
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| Name, Title and Signature of “Contracting Authority 


to Sign on Behalf of Public Works and Government 
Services Canada 


(type or print) 
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Digitally signed by 
Signature: Ha | |, jan pe 


ate: 2021.01 = 
pate’ Stephanie és 


Digitally signed by: Holden, 


Cc | 4 l | Carole 
Date: 2021.01.25 14:30:34 - 


Signature: 05:00 


Date: 


You are requested to sell to her Majesty the Queen in Right of Canada, in accordance with the terms and conditions set out herein, referred to 
herein, or attached hereto, the services listed herein and in any attached sheets at the price set out there of. 
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Canada Canada 
Purchasing Office - Bureau des achats: Title - Sujet 
Systems Software Procurement Division / Division Enterprise Fraud Management 
des achats des logiciels d'exploitation Contract No. - N° du contrat Amendment No. - N° Modif 
Terrasses de la Chaudière B7310-190250/001/EE 001 
4th Floor, 10 Wellington Street Client Reference No. - N° de référence du client Date 
Ath etage, 10, rue Wellington B7310-190250 2021-03-26 
Gatineau — a 
Quebec Requisition Reference No. - N° de la demande 
KIA 0S5 B7310-190250 


File No. - N° de dossier CCC No./N° CCC - FMS No./N° VME 
067ee.B7310-190250 


Financial Codes GST/HST 
Code(s) financier(s) TPS/TVH 


CONTRACT AMENDMENT 
MODIFICATION AU CONTRAT 


The referenced document is hereby amended: unless 
otherwise indicated, all other terms and conditions of F.O.B. - F.A.B. 
the contract remain the same. 


| is bhi cay! Destination 
Ce document est par la présente modifié: sauf indication 
contraire, les modalités du contrat demeurent les mémes. GST/HST - TPS/TVH Duty - Droits 
The Vendor/Firm hereby accepts/acknowledges this See Herein - Voir ci-inclus See Herein - Voir ci-inclus 


amendment. — à - 
Le fournisseur/entrepreneur accepte la présente Destination - of Goods, Services, and Construction: 


modification/en accusé réception. Destination - des biens, services et construction: 
See herein 


Signature Date 
Name, title of person authorized to sign (type or print) 
Nom et titre du signataire autorisé (taper ou imprimer) 


Return signed copy forthwith 
Prière de retourner une copie dûment signée immédiatement 


Comments - Commentaires 


Invoices - Original and two copies to be sent to: 
Factures - Envoyer l'original et deux copies à: 
See herein 


Vendor/Firm Name and Address 
Raison sociale et adresse du 
fournisseur/de l'entrepreneur 


Deloitte LLP 
1600 - 100 Queen Street 
Ottawa 


iste Address Enquiries to: - Adresser toutes questions a: Buyer Id - Id de l'acheteur 


Canada Pignat, Michael 067ee 


Telephone No. - N° de téléphone FAX No. - N° de FAX 
(873)354-4163( ) ( ) - 


Increase (Decrease) - Augmentation (Diminution) 


$0.00 
Revised estimated cost Currency Type - Genre de devise 
Coût révisé estimatif 
$4,637,464.63 CAD 
„For the Minister - Pour le Ministre Digitally signed by: Pignat, Michael 
P | n at | ch zel DN: CN = Pignat, Michael C = CA O = GC OU = PWGSC-TPSGO 
Q 5 © Date: 2021.03.26 11:12:46 -04'00' 
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ca Public Works and 
Government Services 
Canada Canada 
Purchasing Office - Bureau des achats: 
Systems Software Procurement Division / Division 
des achats des logiciels d'exploitation 
Terrasses de la Chaudière 
4th Floor, 10 Wellington Street 
4th etage, 10, rue Wellington 
Gatineau 
Quebec 
KIA 0S5 


DRAFT - PROJET 
CONTRACT AMENDMENT 
MODIFICATION AU CONTRAT 


The referenced document is hereby amended: unless 
otherwise indicated, all other terms and conditions of 

the contract remain the same. 

Ce document est par la présente modifié: sauf indication 
contraire, les modalités du contrat demeurent les mémes. 
The Vendor/Firm hereby accepts/acknowledges this 
amendment. 

Le fournisseur/entrepreneur accepte la présente 
modification/en accusé réception. 


Date Mar, 24, 2021 


Signature Dina Kamal, Al Factory Leader 
Name, title of person authorized to sign (type or print) 
Nom et titre du signataire autorisé (taper ou imprimer) 


Return signed copy forthwith 
Prière de retourner une copie dûment signée immédiatement 


Comments - Commentaires 


Vendor/Firm Name and Address 
Raison sociale et adresse du 
fournisseur/de l'entrepreneur 


Deloitte LLP 

1600 - 100 Queen Street 
Ottawa 

Ontario 

K1P5T8 

Canada 


Travaux publics et 
Services gouvernementaux 
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B7310-190250 


Requisition Reference No. - N° de la demande 
B73 10-190250 
CCC No./N° CCC - FMS No./N° VME 


File No. - N° de dossier 
067ee.B7310-190250 

GST/HST 
TPS/TVH 


Client Reference No. - N° de référence du client 


Financial Codes 
Code(s) financier(s) 


F.O.B. - F.A.B. 
Destination 


GST/HST - TPS/TVH 


See Herein - Voir ci-inclus 


Duty - Droits 
See Herein - Voir ci-inclus 
Destination - of Goods, Services, and Construction: 


Destination - des biens, services et construction: 
See herein 


Invoices - Original and two copies to be sent to: 
Factures - Envoyer l'original et deux copies a: 
See herein 


Address Enquiries to: - Adresser toutes questions a: Buyer Id - Id de l'acheteur 


Pignat, Michael 067ee 
Telephone No. - N° de téléphone FAX No. - N° de FAX 
Increase (Decrease) - Augmentation (Diminution) 

$0.00 


Revised estimated cost 
Coût révisé estimatif 
$4,637,464.63 CAD 


For the Minister - Pour le Ministre 


Currency Type - Genre de devise 
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Contract No. - N° du contrat Amd. No. - N° de la modif. Buyer ID - Id de l'acheteur 
B7310-190250/001/EE 001 067EE 
Client Ref. No. - N° de réf. du client File No. - N° du dossier CCC No./N° CCC - FMS No./N° VME 


B7310-190250 


AMENDMENT NUMBER 001 
ON BEHALF OF IMMIGRATION, REFUGEES AND CITIZENSHIP CANADA 
This amendment is raised to: 
- Update the Invoicing Instructions; 
- Update Annex A Statement of Work, Section 6.2 Deliverables: 


- Update Annex B Basis of Payment, Table 1.1.1 Wave 1 Implementation; 
1) At Section 10. Invoicing Instructions, 
DELETE: 


b) The Contractor must provide all original invoices to the Client Administrative Contact and all copies 
to the Contracting Authority. 


INSERT: 


b) The Contractor must provide all original invoices to the Client Administrative Contact, 
IRCC FIiNinvoices-Factures-iN IRCC@cic.g 


2) At ANNEX A - STATEMENT OF WORK, Section 6.2) Deliverables, 
DELETE: 


6.2 Deliverables 

The Contractor is expected to develop the following deliverables over the course of the EFM Solution 
Implementation Project. The Contractor must provide all deliverables to Technical Authority for review and 
approvals. 


Milestone / Description Forecast 

Deliverable (Business days 
from Contract 
award date) 


*Contract Award* 


Milestone Technical Team engagement with Supplier No later than 20 
days from 
Contract Award 


Deliverable e Project Plan including Schedule and Work Breakdown No later than 20 
Structure (WBS) days from 
Contract Award 


Deliverable e Risk Mitigation Strategies and Plan No later than 20 
days from 
Contract Award 


Deliverable Weekly Status Reports 


Milestone Start development of the solution No later than 40 
days from 
Contract Award 
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Deliverable e Deliverable Specifications and Acceptance Agreements No later than 40 
(Upfront Deliverable Agreements (UDAs days from 
Contract Award 


)) 
Deliverable e Gap Analysis and recommendations to address gaps, if No later than 40 
applicable days from 
Contract Award 


Deliverable e Complete Security Requirements Traceability Matrix No later than 40 
(SRTM) — in consultation with Client. days from 

Contract Award 

Deliverable e Interview / workshop Schedule / plan No later than 40 
days from 


Contract Award 


Deliverable e Technical Solution Design No later than 40 
days from 

Contract Award 

Deliverable e Technical Configuration Document No later than 130 
Contract Award 

Deliverable e Development Plan, if applicable No later than 50 
Contract Award 

Deliverable e Configuration of business rules as defined in use cases. No later than 90 
Contract Award 


Deliverable e Technical Design documents for reports, integrations, No later than 130 
customizations, extensions and workflows, if applicable days from 
Contract Award 


Deliverable e Training manuals No later than 100 
days from 
Contract Award 
Deliverable e Training schedule No later than 100 
days from 
Contract Award 
Milestone Training of technical team on solution No later than 120 
days from 
Contract Award 
Milestone Integration of use cases and reports No later than 120 
days from 
Contract Award 
Milestone Testing/validation of final solution use cases and reports No later than 120 
days from 
Contract Award 
Deliverable e Test Cases and Scripts No later than 120 
days from 
Contract Award 
Deliverable e Configured Test Environment for end-to-end solution No later than 120 
Contract Award 
Milestone Approved Transition Plan No later than 110 
days from 
Contract Award 
Milestone Pilot testing and remediation No later than 120 
days from 
Contract Award 
Deliverable e Test Results and Defect Log No later than 120 
days from 

Contract Award S 
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Milestone Necessary Privacy and Policy updates are completed No later than 120 
days from 

Contract Award 

Milestone Training of Workplace Investigations and Ethics (WIE) No later than 100 
days from 

Contract Award 

Milestone Stakeholder evaluation/approval to proceed No later than 110 
days from 

Contract Award 

Milestone Finalization of the solution No later than 130 
days from 

Contract Award 

Milestone Complete development of the solution No later than 130 
days from 

Contract Award 

days from 

Contract Award 

Deliverable e Deployment Test Plan No later than 130 
days from 

Contract Award 

Deliverable e Deployment Test Results No later than 130 
days from 

Contract Award 

Deliverable e Configured Production Environment No later than 130 
Contract Award 

days from 

Contract Award 

Milestone Start solution implementation No later than 140 
days from 

Contract Award 

Milestone Completed full Implementation of the solution No later than 140 
days from 

Contract Award 


Milestone Evaluation/Remediation and update of use cases/reports No later than 160 
days from 
Contract Award 
Deliverable e Administrator (technical) manuals No later than 160 
days from 
Contract Award 
Deliverable e User (business) manuals No later than 160 
days from 
Contract Award 


Milestone Wave 1 Implementation Project Close-Out Report Within 160 days 


Implementation Project. The Contractor must provide all deliverables to Technical Authority for review and 
approvals. 
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Milestone / Description Forecast 


Deliverable (Business days 


from Contract 
award date) 


Milestone Technical Team engagement with Supplier No later than 20 
days from 

Contract Award 

e Project Plan including Schedule and Work Breakdown No later than 20 
D01 Structure (WBS) days from 
Contract Award 


Deliverable e Risk Mitigation Strategies and Plan No later than 20 
D02 days from 
Contract Award 


Deliverable e Weekly Status Reports 
D03 


Milestone Start development of the solution No later than 40 
days from 

Contract Award 

Deliverable e Deliverable Specifications and Acceptance Agreements No later than 40 


D04 (Upfront Deliverable Agreements (UDAs days from 
Contract Award 


)) 
D05 applicable days from 
Contract Award 
e Complete Security Requirements Traceability Matrix No later than 40 
D06 (SRTM) — in consultation with Client. days from 


Contract Award 


e Interview / workshop Schedule / plan No later than 40 
DO7 days from 
Contract Award 

Deliverable e Technical Solution Design No later than 40 
D08 days from 
Contract Award 

Deliverable e Technical Configuration Document No later than 130 
Contract Award 

D10 days from 
Contract Award 

Deliverable e Configuration of business rules as defined in use cases. No later than 90 
Contract Award 


Deliverable e Technical Design documents for reports, integrations, No later than 130 
D12 customizations, extensions and workflows, if applicable days from 


Contract Award 


Deliverable e Training manuals No later than 100 
D13 days from 
Contract Award 

Deliverable e Training schedule No later than 100 
D14 days from 
Contract Award 

days from 

Contract Award 
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Milestone / Description Forecast 


Deliverable (Business days 


from Contract 
award date) 


Milestone Integration of use cases and reports No later than 120 
days from 

Contract Award 

Milestone Testing/validation of final solution use cases and reports No later than 120 
days from 

Contract Award 

Deliverable e Test Cases and Scripts No later than 120 
Contract Award 

D16 days from 
Contract Award 


Milestone Approved Transition Plan No later than 110 
days from 
Contract Award 


days from 

Contract Award 

D17 days from 
Contract Award 

Milestone Necessary Privacy and Policy updates are completed No later than 120 
days from 

Contract Award 

days from 

Contract Award 

Milestone Stakeholder evaluation/approval to proceed No later than 110 
days from 

Contract Award 

days from 

Contract Award 

Milestone Complete development of the solution No later than 130 
days from 

Contract Award 

Deliverable e Deployment Approach and Prerequisites No later than 130 
Contract Award 

Deliverable e Deployment Test Plan No later than 130 
Contract Award 


Deliverable e Deployment Test Results No later than 130 
D20 days from 

Contract Award 
Deliverable e Configured Production Environment No later than 130 
D21 days from 


Contract Award 


Deliverable e “go/no-go” checklist to be completed with input by IRCC No later than 130 
D22 days from 
Contract Award 
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Milestone / Description Forecast 
Deliverable (Business days 
from Contract 
award date) 
days from 
Contract Award 
Milestone Completed full Implementation of the solution No later than 140 
days from 
Contract Award 


Milestone Evaluation/Remediation and update of use cases/reports No later than 160 
days from 

Contract Award 

e Administrator (technical) manuals No later than 160 
D23 days from 
Contract Award 


Deliverable e User (business) manuals No later than 160 
D24 days from 
Contract Award 


Wave 1 Implementation Project Close-Out Report Within 160 days 


3) At ANNEX B - BASIS OF PAYMENT, Table 1.1.1. Wave 1 Implementation, 


DELETE: 


entation 


Wave 1 Total: 


$2,640,000.00 


INSERT: 


Wave 1 Implementation 


ilestone 3 — Completion of D09, D12 to D17 End of Period 6 
Milestone 4 — Completion of D18 to D24 End of Period 8 
Wave 1 Total: 


$2,640,000.00 
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Q Government Services Services gouvernementaux 
Canada Canada 

Purchasing Office - Bureau des achats: Title - Sujet 

Systems Software Procurement Division / Enterprise Fraud Management 

Division des achats des logiciels d'exploitation Contract No. - N° du contrat Date 

PR ne se B7310-190250/001/EE 2021-01-06 

He ee 10.¢ | a o Client Reference No. - N° de référence du client 

die 8 B7310-190250 

Gatineau 

Quebec Requisition No. - N° de la demande 

K1A 0S5 B7310-190250 
File No. - N° de dossier CCC No./N° CCC - FMS No./N° VME 
067ee.B73 10-190250 
Financial Code(s) GST/HST 
Code(s) financier(s) TPS/TVH 
0500-0140-679 1-55802-73 10-9998 

CONTRACT - CONTRAT 

Your proposal is accepted to sell to Her Majesty the Queen F.O.B. - F.A.B. 

in right of Canada, in accordance with the terms and conditions Destination 

set out herein, referred to herein or attached hereto, the goods, 

services, and construction listed herein and on any attached GST/HST - TPS/TVH Duty - Droits 

sheets at the price or prices set out therefor. See Herein - Voir ci-inclus See Herein - Voir ci-inclus 


Destination - of Goods, Services, and Construction: 


Nous acceptons votre proposition de vendre à Sa Majesté ees : | ; 
Destination - des biens, services et construction: 


la Reine du chef du Canada, aux conditions énoncées ou 
incluses par référence dans les présentes, et aux annexes See herein 
ci-jointes, les biens, services et construction énumérés dans 

les présentes, et sur toute feuille ci-annexée, au(x) prix indiqué(s). 


Comments - Commentaires 


Invoices - Original and two copies to be sent to: 
Factures - Envoyer l'original et deux copies à: 
See herein 


Vendor/Firm Name and Address 


Raison sociale et adresse du 
fournisseur/de l'entrepreneur 


Deloitte LLP 
1600 - 100 Queen Street 
Ottawa 

Ontario 

KIPST8 

Canada 


Address Enquiries to: - Adresser toutes questions a: Buyer Id - Id de l'acheteur 
Pignat, Michael 067ee 


Telephone No. - N° de téléphone FAX No. - N° de FAX 
(873) 354-4163 ( ) () - 


Total Estimated Cost - Coût total estimatif | Currency Type - Devise 


$4,637,464.63 CAD a a 
For the Minister - Pour le Ministre aana, Sampan 
_DN: CN = Chadha, Sampan C = 
mnar * CA O = GC OU = PWGSC-TPSGC 
ata pales Date: 2021.01.06 13:34:22 -05'00' 
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1. Requirement 


a) Deloitte LLP (The “Contractor”) agrees to supply to the Client the goods and/or services 
described in the Contract, including the Annex A Statement of Work, in accordance with, and at the 
prices set out in, the Contract. The scope includes: 


i. granting the rights to use the available EFM Solution Licensed Software, in 
accordance with the Contract, including the Statement of Work, which is subject to a 
Software Warranty Period of 12 months; 


li. providing EFM Solution Software Maintenance and Support during the Contract 
Period, as per levels specified in this document: 


lil. providing licensed documentation for the Licensed Software 
IV. providing the EFM Solution Documentation in English (and French, if available); and 
V. providing all the contract deliverables in accordance with the Contract. 


b) Client: Immigration, Refugees and Citizenship Canada (IRCC) is the initial Client that will use 
the Enterprise Fraud Management Solution (EFM Solution). However, this Contract will also 
allow Canada to make the EFM Solution available to any department, Crown corporation or agency 
as described in the Financial Administration Act (as amended from time to time); any other party 
for which the Department of Public Works and Government Services has been authorized to act 
from time to time under section 16 of the Department of Public Works and Government Services 
Act (each a “Client”). Although Canada may make the EFM Solution available to any or all the 
Clients, this Contract does not preclude Canada from using another method of supply for entities 
of the Government of Canada with same or similar needs. When the EFM Solution is made 
available to Clients other than the initial Client, any required professional services or training will 
be purchased under a separate contract. 


c) Reorganization of Client: The Contractor's obligation to perform the Work will not be affected by 
(and no additional fees will be payable as a result of) the renaming, reorganization, reconfiguration, 
or restructuring of any Client. The reorganization, reconfiguration and restructuring of the Client 
includes the privatization of the Client, its merger with another entity, or its dissolution, where that 
dissolution is followed by the creation of another entity or entities with mandates similar to the 
original Client. In connection with any form of reorganization, Canada may designate another 
department or government body as the Contracting Authority or Technical Authority, as required to 
reflect the new roles and responsibilities associated with the reorganization. 


d) Defined Terms: Words and expressions defined in the General Conditions or Supplemental 
General Conditions and used in the Contract have the meanings given to them in the General 
Conditions or Supplemental General Conditions. Also, the following words and expressions have 
the following meanings: 


any reference to a “deliverable” or “deliverables” includes the license to use the Licensed 
software (the Licensed Software itself is not a deliverable, because the Licensed Software is only 
being licensed under the Contract, not sold or transferred). 


2. License 


a) License: The Contractor must provide the Licensed Software described in the Contract, which 
includes everything described in this article, as well as anything further required to ensure that 
the Client is able to use all the features and functionality of the Licensed Software listed in 
Annex A, including but not limited to providing any and all agents, host agents, access 
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licenses, drivers, application program interfaces, adapters, connectors, plug-ins, and software 
development tool kits. 


b) Grant of Licenses: In addition to the obligations set out in Section 02 (License Grant) of 4003 
- Licensed Software, the Contractor grants to Canada a license to use the Licensed Software 
in accordance with the Contract. This license is non-exclusive, perpetual, irrevocable, world- 
wide, fully paid and without royalties. The license cannot be restricted, modified or revised in 
any way by the Contractor. 


This license includes the right for Canada to install, copy, deploy and use the Licensed 
software, which includes the rights: 


i. to deploy, in whole or in part, any or all of the software products that form part of the 
Licensed Software, together or separately, and in as many installations and locations 
(off-site workplaces or work environments “in the field”, and in-home work 
environments for the Client's business purposes) as the Client sees fit; 


Il. to create or process an unlimited number of documents, transactions, data and events; 


lil. to use English and French versions (if available, these must be the “Canadian English” 
and “Canadian French’ versions); 


IV. to run the Licensed Software on multiple computing platforms and devices; under the 
Contract, “devices” are defined as mainframes, servers, desktops, workstations, 
notebooks, laptops, personal digital assistant(s) and networking equipment and 
peripheral equipment such as switches, routers, hubs, bridges, phones and Gateways, 
and any other equipment that has a central processor unit(s), mass storage device(s), 
input output device(s) and operating system; 


V. to grant access through a browser using Internet, intranet and extranet environments 
or any other connections to anyone (Canadians and non-Canadians and employees 
and contractors of Canada) who uses the services and programs provided by Canada 
(regardless of their location) to access, view, enter, search, exchange and read 
information held and created by the Client using the Licensed Software; 


vi. to make this use by way of a network, the Internet, an intranet, an extranet, a virtual 
private network (VPN), an inter-network, or such other means as may become possible 
from time to time so that users have “universal access rights” (i.e., a right to access the 
Licensed Software by any means from any location as may become possible from time 
to time), whether their means of access is secure, wireless, mobile or by any other 
means available from time to time; 


vii. to make this use regardless of the operating systems, software applications and 
Application Programming Interface(s) (API) that the Client may be using from time to 
time; however, Canada acknowledges that the Contractor is not granting any license 
rights to software other than the Licensed Software; 


viii. to receive the Licensed Software from the Contractor on Canada’s choice(s) of the 
media on which the Contractor makes the Licensed Software available to customers 
(including CD-ROM, Internet download, and such other media that the Contractor uses 
to distribute the Licensed Software at any given time); 


IX. to distribute the Licensed Software to individual Client Users on Canada's choice(s) of 
media; and 
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X. to continue to use the Licensed Software regardless of any changes made at any given 
time, including but not limited to changes in the operating system, other applications, 
hardware, peripherals or devices with which the Licensed Software operates; however, 
the Contractor is not required to deliver a new or different version of the Licensed 
Software to enable the Client Users to continue to use the Licensed Software in a 
different environment than the one(s) described in the Contract (unless expressly 
required to do so as part of the warranty or software maintenance for the Licensed 
Software described in the Contract), 


all without affecting the pricing in the Contract and without requiring the Client to obtain 
additional licences or accept amended licence terms for the Licensed Software. The 
“Licensed Software’ includes all the software listed in Annex B. 


c) Optional Goods - Purchase Additional Licenses: The Contractor grants to Canada the 
irrevocable option to purchase licenses at the price set out in the Basis of Payment on the 
same terms and conditions granted under the Contract. The option(s) may be exercised at any 
time during the Contract Period, as many times as Canada chooses. The option(s) may only 
be exercised by the Contracting Authority by notice in writing and will be evidenced, for 
administrative purposes only, by a contract amendment. 


3. Licensed Software Warranty, Software Maintenance And Support 


a) Licensed Software Warranty: Despite Section 15 (Warranty) of 4003 or anything else to the 
contrary in this Contract, the "Warranty Period" begins on the date the Licensed Software 
and the deliverables are accepted in accordance with the terms of this Contract and continues 
for 12 months. 


b) Software Maintenance: In addition to the obligations set out in Section 15 (Warranty) of 4003 
- Licensed Software, and the Contractor's obligations under 4004 - Maintenance and Support 
Services for Licensed Software, the Contractor must provide the following services as part of 
the "Software Maintenance" throughout the "Software Support Period", which is identified 
in Annex A, plus any period during which Canada has exercised its option under the Contract 
to extend the Software Maintenance. The Contractor must provide the Client with the most 
recent release(s) and version(s) of the Licensed Software during the period of the Software 
Maintenance, as soon as they are available. 


i. The Contractor must keep track of software releases for the purpose of configuration control. 


li. In addition to the Contractor's obligations under Section 3 (Maintenance Releases) of 4004 - 
Maintenance and Support Services for Licensed Software, the Contractor must deliver the 
following software code as part of the Software Maintenance: 


1. all Bug Fixes, Software Patches, and all other Enhancements; 
2. all Upgrades, updates, major and minor New Releases, and Renames; 


3. all Extensions and other modifications, including but not limited to drivers, service packs, 
and Service Releases; 


all application programming interfaces (APIs), plug-ins, applets and adapters; 


5. all rewrites, including in other programming language(s), where the original version(s) is 
no longer being maintained by the software publisher; and 


6. on request, all backgrades or downgrades; however, if these backgrades or downgrades 
are versions predating the version of the Licensed Software acquired from the Contractor, 
the backgrade or downgrade version is provided without warranty and the Contractor will 
have no obligation to provide Software Maintenance or Support Services for the backgrade 
or downgrade version of the Licensed Software, 


which will be made available by the Software Publisher during the Software Support Period. 
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jii. The Contractor must continue to maintain the most recent version of the Licensed Software 
(i.e., the version or "build" originally licensed under the Contract, or succeeding versions as 
updated through Software Maintenance) as a commercial product (i.e. the Contractor or the 
software publisher must be continuing to develop new code in respect of the Licensed Software 
to maintain its functionality, enhance it, and deal with Software Errors) for the Contract Period 
from the date this Contract is issued. After that time, if the Contractor or the software publisher 
decides to discontinue or no longer maintain the then-current version or "build" of the Licensed 
Software and, instead, decides to provide Upgrades to the Licensed Software as part of the 
Software Maintenance, the Contractor must provide written notice to Canada at least 12 
months in advance of the discontinuation. 


C) Software Support: In addition to the obligations set out in Supplemental General Conditions 
4004, the Contractor must provide the following as part of the “Software Support” throughout 
the “Software Support Period”, which is identified in Annex A, plus any period during which 
Canada has exercised its option under the Contract to extend the Software Support. The 
Software Support includes the following Technical Hotline Support and Web Support services: 


i. Technical Hotline Support: In addition to the requirements of Supplemental General 
Conditions 4004, the Contractor must provide the Technical Hotline Support through the 
Contractor's toll-free hotline at 1-800-727-0025, in English (and French, if available), 24 
hours a day (excluding statutory holidays observed by the federal government in the 
province from which the call is made). The Contractor must answer or return all calls (with 
a live service agent) within 60 minutes of the initial time of the Client or User's initial call. 
The Contractor's personnel must be qualified and able to respond to the Client's and any 
Client User's questions and, to the extent possible, be able to resolve user problems over 
the telephone and provide advice regarding configuration problems relating to the Licensed 
Software. 


Il. E-Mail Support: The Contractor must provide E-Mail Support through the Contractor's e- 
mail address at , In English (and French, if available). E-Mail 
Support must be available from 8:00 A.M. to 5:00 P.M. Eastern Time, Monday to Friday 
(excluding statutory holidays observed by the federal government in the province from 
which the e-mail is sent). The Contractor must answer all e-mails (automatically generated 
e-mails will not be considered to meet this requirement) within 60 minutes of the initial time 
of the Client's initial e-mail. 


lll. Web Support: The Contractor must provide Canada with technical web support services 
through a website that must include, as a minimum, frequently asked questions and on- 
line software diagnostic routines, support tools, and services. The Contractor's website 
must provide support in English. The Contractor's website must be available to Canada's 
users 24 hours a day, 365 days a year, and must be available 99% of the time. The 
Contractor's website address is htto://support.sas.com . 


d) Optional Goods - Extend Software Support Period: The Contractor grants to Canada the 
irrevocable option(s) to extend the Software Support Period by seven (7) additional one-year 
periods, exercisable at any time during the Contract Period. The Contractor agrees that, during 
the entire Software Support Period, the prices will be those set out in the Basis of Payment. 
The option(s) may only be exercised by the Contracting Authority by notice in writing and will 
be evidenced, for administrative purposes only, by a contract amendment. 


e) Optional Goods - Purchase Software Maintenance and Support on Additional 
License(s): The Contractor grants to Canada the irrevocable option to purchase Software 
Maintenance and Support on the additional licenses, if Canada exercises its option for this 
additional Software Maintenance and Support of the Licensed Software, Canada will pay the 
Contractor the firm annual price set out in the Basis of Payment, payable annually in advance, 
FOB destination, and Applicable Taxes extra. 
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4. Standard Clauses and Conditions 


All clauses and conditions identified in the Contract by number, date and title are set out in the 
Standard Acquisition Clauses and Conditions Manual issued by Public Works and Government 
Services Canada (PWGSC). The Manual is available on the PWGSC Website: 
https://buyandsell.gc.ca/policy-and-guidelines/standard-acquisition-clauses-and-conditions-manual/all. 


a) General Conditions 


i. 2030 (2018-06-21), General Conditions - Higher Complexity - Goods, apply to and form 
part of the Contract. 


b) Supplemental General Conditions 
i. 4003, (2010-08-16), Supplemental General Conditions - Licensed Software; 


Il. 4004, (2013-04-25), Supplemental General Conditions - Maintenance and Support 
Services for Licensed Software; 


iii. 4006 (2010-08-16) Contractor to Own Intellectual Property Rights in Foreground 
Information 


apply to and form part of the Contract. 


5. Security Requirements 
5.1 The following security requirements (SRCL and related clauses provided by the Contract Security 
Program) apply and form part of the Contract. 


A. SECURITY REQUIREMENTS FOR CANADIAN SUPPLIERS: 


a) The Contractor/Offeror must, at all times during the performance of the Contract/Standing Offer, 
hold a valid Designated Organization Screening (DOS), issued by the Canadian Industrial 
security Directorate (CISD), Public Works and Government Services Canada (PWGSC). 


b) The Contractor/Offeror personnel requiring access to PROTECTED information, assets or 
sensitive work site(s) must EACH hold a valid RELIABILITY STATUS, granted or approved by 
CISD/PWGSC. 


c) The Contractor/Offeror MUST NOT remove any PROTECTED information or assets from the 
identified work site(s), and the Contractor/Offeror must ensure that its personnel are made aware 
of and comply with this restriction. 


d) Subcontracts which contain security requirements are NOT to be awarded without the prior 
written permission of CISD/PWGSC. 


e) The Contractor/Offeror must comply with the provisions of the: 


i. Security Requirements Check List and security guide (if applicable), attached at Annex C; 
li. Industrial Security Manual (Latest Edition). 


B. SECURITY REQUIREMENTS FOR FOREIGN SUPPLIERS: 


The Canadian Designated Security Authority (Canadian DSA) for industrial security matters in Canada is 
the Industrial Security Sector (ISS), Public Works and Government Services Canada (PWGSC), 
administered by International Industrial Security Directorate (IISD), PWGSC. The Canadian DSA is the 
authority for confirming Contractor compliance with the security requirements for foreign suppliers. The 
following security requirements apply to the foreign recipient Contractor incorporated or authorized to do 
business in a jurisdiction other than Canada and delivering outside of Canada the services listed and 
described in the subsequent contract. 
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a) 


The Foreign recipient Contractor must be from a Country within the North Atlantic Treaty 
Organization (NATO), the European Union (EU) or from a country with which Canada has an 
international bilateral security instrument. The Contract Security Program (CSP) has international 
bilateral Instruments with the countries listed c on the following PWGSC website: 


The Foreign recipient Contractor must, at all times during the performance of the contract, hold an 
equivalence to a valid Designated Organization Screening (DOS), issued by the Canadian DSA as 
follows: 

i. The Foreign recipient Contractor must provide proof that they are incorporated or 
authorized to do business in their jurisdiction. 

ii. The Foreign recipient Contractor must not begin the work, services or performance until 
the Canadian Designated Security Authority (DSA) is satisfied that all contract security 
requirement conditions have been met. Canadian DSA confirmation must be provided, in 
writing, to the foreign recipient Contractor in an Attestation Form, to provide confirmation 
of compliance and authorization for services to be performed. 

iii. The Foreign recipient Contractor must identify an authorized Contract Security Officer 
(CSO) and an Alternate Contract Security Officer (ACSO) (if applicable) to be responsible 
for the overseeing of the security requirements, as defined in this contract. This individual 
will be appointed by the proponent foreign recipient Contractor's Chief Executive officer or 
Designated Key Senior Official, defined as an owner, officer, director, executive, and or 
partner who occupy a position which would enable them to adversely affect the 
organization’s policies or practices in the performance of the contract. 

IV. The Foreign recipient Contractor must not grant access to CANADA PROTECTED B 
information/assets, except to its personnel subject to the following conditions: 

a. Personnel have a need-to-know for the performance of the contract: 

b. Personnel have been subject to a Criminal Record Check, with favourable 
results, from a recognized governmental agency or private sector organization 
in their country as well as a Background Verification, validated by the Canadian 
DSA; 

c. The Foreign recipient Contractor must ensure that personnel provide consent to 
share results of the Criminal Record and Background Checks with the Canadian 
DSA and other Canadian Government Officials, if requested; and 

d. The Government of Canada reserves the right to deny access to CANADA 
PROTECTED information/assets to a foreign recipient Contractor for cause. 

CANADA PROTECTED information/assets provided or generated pursuant to this contract must not 
be further provided to a third party Foreign recipient Subcontractor unless: 

i. written assurance is obtained from the Canadian DSA to the effect that the third-party 
Foreign recipient Subcontractor has been approved for access to CANADA 
PROTECTED information/ assets by the Canadian DSA; and 

ii. written consent is obtained from the Canadian DSA, if the third-party Foreign recipient 
Subcontractor is located in a third country. 

The Foreign recipient Contractor MUST NOT remove CANADA PROTECTED information/assets 
from the identified work site(s), and the foreign recipient Contractor must ensure that its personnel 
are made aware of and comply with this restriction. 

The Foreign recipient Contractor must not use the CANADA PROTECTED information/assets for 
any purpose other than for the performance of the contract without the prior written approval of the 
Government of Canada. This approval must be obtained from the Canadian DSA. 
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All CANADA PROTECTED information/assets, furnished to the foreign recipient Contractor/Subcontractor 
or produced by the foreign recipient Contractor, must also be safeguarded as follows: 


a) The Foreign recipient Contractor must immediately report to the Canadian DSA all cases in which it 
is known or there is reason to suspect that CANADA PROTECTED information/assets pursuant to 
this contract has been compromised. 

b) The Foreign recipient Contractor must immediately report to the Canadian DSA all cases in which it 
is Known or there is reason to suspect that CANADA PROTECTED information/assets accessed by 
the foreign recipient Contractor, pursuant to this contract, have been lost or disclosed to 
unauthorized persons. 

c) The Foreign recipient Contractor must not disclose CANADA PROTECTED information/assets to a 
third party government, person, firm or representative thereof, without the prior written consent of the 
Government of Canada. Such consent must be sought through the Canadian DSA. 

d) The Foreign recipient Contractor must provide the CANADA PROTECTED information/assets a 
degree of safeguarding no less stringent than that provided by the Government of Canada in 
accordance with the National Policies, National Security legislation and regulations and as 
prescribed by the Canadian DSA. 


6. Task Authorization 

The Work or a portion of the Work to be performed under the Contract will be on an "as and when 
requested basis" using a Task Authorization (TA). The Work described in the TA must be in accordance 
with the scope of the Contract. 


6.1 Task Authorization Process 
Task Authorization Process: 

a) The Client Administrative Contact will provide the Contractor with a description of the task using 
the "Task Authorization Form for non-DND clients" or "DND 626, Task Authorization Form" or 
"Task Authorization" form specified in Annex F. 

b) The Task Authorization (TA) will contain the details of the activities to be performed, a description 
of the deliverables, and a schedule indicating completion dates for the major activities or 
submission dates for the deliverables. The TA will also include the applicable basis (bases) and 
methods of payment as specified in the Contract. 

c) The Contractor must provide the Client Administrative Contact, within a mutually agreed upon 
timeframe, the proposed total estimated cost for performing the task and a breakdown of that 
cost, established in accordance with the Basis of Payment specified in the Contract. 

d) The Contractor must not commence work until a TA authorized by the Client Administrative 
Contact has been received by the Contractor. The Contractor acknowledges that any work 
performed before a TA has been received will be done at the Contractor's own risk. 


6.2 Task Authorization Limit 
The Client Administrative Contact may authorize individual task authorizations up to a limit of $65,000.00, 
Applicable Taxes included, inclusive of any revisions. 


Any task authorization to be issued in excess of that limit must be authorized by the Client Administrative 
Contact and/or Contracting Authority before issuance. 
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6.3 Canada's Obligation - Portion of the Work - Task Authorizations 
Canada's obligation with respect to the portion of the Work under the Contract that is performed through 
task authorizations is limited to the total amount of the actual tasks performed by the Contractor. 


6.4 Periodic Usage Reports - Contracts with Task Authorizations 
The Contractor must compile and maintain records on its provision of services to the federal government 
under authorized Task Authorizations issued under the Contract. 


The Contractor must provide this data in accordance with the reporting requirements detailed below. If 
some data is not available, the reason must be indicated. If services are not provided during a given 
period, the Contractor must still provide a "nil" report. 


The data must be submitted on a quarterly basis to the Contracting Authority. 
The quarterly periods are defined as follows: 


1st quarter: April 1 to June 30; 

2nd quarter: July 1 to September 30; 

3rd quarter: October 1 to December 31; and 
Ath quarter: January 1 to March 31. 


The data must be submitted to the Contracting Authority no later than 15 calendar days after the end of 
the reporting period. 


Reporting Requirement- Details 


À detailed and current record of all authorized tasks must be kept for each contract with a task 
authorization process. This record must contain: 


For each authorized task: 
a) the authorized task number or task revision number(s); 
b) atitle or a brief description of each authorized task; 
c) the total estimated cost specified in the authorized Task Authorization (TA) of each task, 
exclusive of Applicable Taxes; 
d) the total amount, exclusive of Applicable Taxes, expended to date against each authorized task; 
e) the start and completion date for each authorized task; and 
f) the active status of each authorized task, as applicable. 


For all authorized tasks: 
a) the amount (exclusive of Applicable Taxes) specified in the contract (as last amended, as 
applicable) as Canada's total liability to the contractor for all authorized TAs; and 
b) the total amount, exclusive of Applicable Taxes, expended to date against all authorized TAs. 


7. Term of Contract 


a) Contract Period 
The “Contract Period” is the entire period of time during which the Contractor is obligated to 
perform the Work, which includes: 
i. The “Initial Contract Period”, which begins on the date the Contract is awarded and ends 
three (3) year(s) later; and 
Il. The period during which the Contract is extended, if Canada chooses to exercise any 
options set out in the Contract. 
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b) a to Extend the Contract 
The Contractor grants to Canada the irrevocable option to extend the term of the Contract 
by up to seven (7) additional one-year period(s) under the same conditions. The Contractor 
agrees that, during the extended period of the Contract, it will be paid in accordance with 
the applicable provisions as set out in the Basis of Payment. 


Il. Canada may exercise this option at any time by sending a written notice to the Contractor 
at least five (5) calendar days before the expiry date of the Contract. The option may only 
be exercised by the Contracting Authority, and will be evidenced for administrative 
purposes only, through a contract amendment. 


c) Optional Goods and/or Services 

l. The Contractor grants to Canada the irrevocable option to acquire the goods, services or 
both described at Section 7.15 - Payment of the Contract under the same terms and 
conditions, and at the prices stated in Annex B — Basis of Payment — Price Schedule. 

li. The option may only be exercised by the Contracting Authority by notice in writing and will 
be evidenced, for administrative purposes only, through a contract amendment. 

lll. The Contracting Authority may exercise the option at any time before the expiry of the 
Contract by sending a written notice to the Contractor. 


8. Authorities 
8.1 Contracting Authority 


The Contracting Authority for the Contract is: 


Name: Michael Pignat 

Title: Supply Specialist 
Public Works and Government Services Canada 
Acquisitions Branch 


Address: 10 rue Wellington Gatineau, QC 
Telephone: 873-354-4163 
E-mail address: Michael. pignat@tpsgc-pwgsc.gc.ca 


The Contracting Authority is responsible for the management of the Contract and any changes to the 
Contract must be authorized in writing by the Contracting Authority. The Contractor must not perform 
work in excess of or outside the scope of the Contract based on verbal or written requests or instructions 
from anybody other than the Contracting Authority. 


8.2 Technical Authority 
The Technical Authority for the Contract is: 


Name: Andrew Peters 

Title: Manager, IT Security Operations 

Organization: Immigration, Refugees and Citizenship Canada 
Address: 365 Laurier Ave W Ottawa, ON K1A 1L1 
Telephone: 613-437-6334 

E-mail address: Andrew.Peters@cic.gc.ca 


The Technical Authority named above is the representative of the department or agency for whom the 
Work is being carried out under the Contract and is responsible for all matters concerning the technical 
content of the Work under the Contract. Technical matters may be discussed with the Technical Authority, 
however the Technical Authority has no authority to authorize changes to the scope of the Work. 
Changes to the scope of the Work can only be made through a contract amendment issued by the 
Contracting Authority. 
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8.3 Client Administrative Contact 
The Client Administrative Contact is: 


Name: Joanne Dubeau 

Title: Senior Procurement Officer 

Organization: Immigration, Refugees and Citizenship Canada 
Address: 70 rue Crémazie Gatineau, QC K1A 1L1 
Telephone: 873-408-0518 

E-mail address: Joanne.Dubeau@cic.gc.ca 


The Client Administrative Contact must receive the original Invoice. All inquiries for request for payment 
must be made to the Client Administrative Contact. 


8.4 Contractor's Representative 
The Contractor's Representative for the Contract is: (will be completed upon Contract Award) 


Name: Dina Kamal 

Title: Partner 

Organization: Deloitte LLP 

Address: 8 Adelaide St. West East Tower, Suite 200 
Toronto, ON 
M5H OA9 

Telephone: 

E-mail address: Ddeloitte. ca 

9. Payment 

9.1 Basis of Payment 


Payment for all of the Work will be made in Canadian currency. 
All Goods, when applicable, must be FOB destination, all customs duties included. 


a) Wave 1 Implementation 
Canada will pay the Contractor a Wave 1 EFM Implementation Firm Lot Price detailed in 
Annex B - Basis of Payment - Price Schedule, customs duties included and Applicable Taxes 
extra for the entirety of the Work in the Statement of Work in Annex “A” relating to the entirety 
of the Wave 1 EFM Implementation Work, including, but not limited to, the completion of all 
related activities, services, plans, and execution satisfactorily completed by the Contractor. 
The Wave 1 Implementation Firm Lot Price is divided into milestones as set out in Annex B - 
Basis of Payment — Price Schedule. Each Wave 1 Implementation milestone amount is 
payable only after successful completion and acceptance by Canada of the respective 
milestone to which the milestone amount applies. The firm price includes the warranty during 
the Wave 1 Implementation Warranty Period. 


b) EFM Solution Licensed Software 
For the license(s) to use the Licensed Software (including Warranty and Software 
Documentation) in accordance with the Contract, Canada will pay the Contractor the firm 
price(s) set out in Annex B — Basis of Payment, DDP (Delivery Duty Paid), including all 
customs duties, GST/HST extra. 


c) Maintenance and Support for the Licensed Software 
For the Software Maintenance and Support, as detailed in this Contract, Canada will pay the 
Contractor the firm annual price(s) set out in Annex B — Basis of Payment, payable in advance, FOB 
Origin, including all customs duties, Applicable Taxes extra. 
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d) 


e) 


f) 


g) 


Optional goods - Additional Software Licenses 

For additional licenses to use the Licensed Software and the Maintenance and Support, if 
Canada exercises its option, Canada will pay the Contractor the firm price(s) set out in 
section 3.1 of Annex B — Basis of Payment, FOB destination, including all customs duties. 
Applicable Taxes are extra and payable by the Client. For greater certainty, the term of such 
license will be for one year and shall be co-termed at the first renewal period as further 
described in subsection. 


For Software Maintenance and Support on additional Software Licenses: In order to provide for a 
common termination date for the Software Maintenance and Support Services, Canada will pay an 
amount based on the firm annual price divided by 365 days and then multiplied by the number of days to 
the common Maintenance termination date. In any subsequent year in which Canada exercises its option 
to obtain Maintenance, the full amount will apply on the existing Licensed Software. 


Optional Professional Services 

Task Authorizations (TA) authorize Work that is not otherwise covered by another section of the 
SOW, and for additional Work that may be added by Canada to Annex A. The Work described in 
the TA must be in accordance with the scope of the Contract and can be requested at any time by 
Canada during the entire Term of the Contract. Canada will pay the Contractor in arrears and no 
more than once a month, up to the Ceiling Price for an authorized Task Authorization, for actual 
time worked and any resulting deliverables in accordance with the all-inclusive fixed daily rates for 
Professional Services, in accordance with the prices included in Annex B- Basis of Payment, as and 
when requested by Canada during the Term of the Contract, Customs duties are included and 
Applicable Taxes are extra. For professional services, Partial days will be prorated based on actual 
hours worked based on a 7.5-hour workday. 


Professional Services Rates 

In Canada's experience, Bidders from time to time propose rates at the time of bidding for one or 
more categories of resources that they later refuse to honour, on the basis that these rates do not 
allow them to recover their own costs and/or make a profit. This denies Canada of the benefit of the 
awarded contract. If the Contractor refuses, or is unable, to provide an individual with the 
qualifications described in the Contract within the time described in the Contract (or proposes instead 
to provide someone from an alternate category at a different rate), whether or not Canada terminates 
the Contract as a whole, Canada may impose sanctions or take other measures in accordance with 
the PWGSC Vendor Performance Policy (or equivalent) then in effect, which may include prohibiting 
the Contractor from bidding on future requirements that include any professional services, or 
rejecting the Contractor's other bids for professional services requirements on the basis that the 
Contractor's performance on this or other contracts is sufficiently poor to jeopardize the successful 
completion of other requirements. 


Software Maintenance and Support Services Pricing Stability 


The Contractor acknowledges that it is important to Canada to be able to continue to access 
Software Maintenance and Support Services for the Licensed Software after the Term of Contract. 
The Contractor accordingly offers to continue to provide Software Maintenance and Support 
Services at reasonable annual rates and on all of the other terms and conditions set out in this 
Contract, subject to execution by the parties of a formal contract(s) therefor. For each of the 2 years 
that follow the Term of Contract, the Contractor hereby offers annual rates that are the lesser of: 


the Contractor's then current published rates; and 


the previously contracted rates adjusted by the percentage difference in the Consumer Price Index 
(CPI) as determined by Statistics Canada, for the 12 month period immediately preceding the date 
on which the price change is to be effective; and 


2% more than the annual rates provided to Canada in the preceding year under this Contract or under 
any extension entered into pursuant to this Article; 


and the Contractor's obligations under this Article shall survive termination or expiry of this Contract. 
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h) Competitive Award 
The Contractor acknowledges that the Contract has been awarded as a result of a competitive 
process. No additional charges will be allowed to compensate for errors, oversights, misconceptions 
or underestimates made by the Contractor when bidding for the Contract. 


9.2 Method of Payment — Multiple Payments 
H1001C (2008-05-12), Multiple Payments 


a) Method of Payment — Wave 1 Implementation 


Canada will make milestone payments in accordance with the milestones detailed in Annex B - Basis of 
Payment and the payment provisions of the Contract if: 


i. an accurate and complete claim for payment using form PWGSC-TPSGC 1111, Claim for 
Progress Payment, and any other document requested by the Contracting Authority have 
been submitted in accordance with the invoicing instructions provided in the Contract; 

ii. all the certificates appearing on form PWGSC-TPSGC 1111 have been signed by the 
respective authorized representatives; 

lii. all work associated with the milestone and as applicable any deliverable required have been 
completed and accepted by Canada. 


b) Method of Payment - Advance Payment for EFM Solution Software Licenses during the 
Initial and Optional Contract Periods 


i. Canada will make the annual advance payment to the Contractor for the EFM Solution 
Software Licenses within 30 days after receiving a complete invoice (and any required 
substantiating documentation). 

li. If Canada disputes an invoice for any reason, Canada will pay the Contractor the undisputed 
portion of the invoice, as long as the undisputed items are separate line items on the invoice 
and are owing. In the case of disputed invoices, the invoice will only be considered to have 
been received for the purposes of the section of the General Conditions entitled “Interest on 
Overdue Accounts” once the dispute is resolved. 

lll. The Contractor acknowledges that this is an advance payment and that, despite anything to 
the contrary in the Contract, Canada will perform acceptance procedures for the goods and/or 
services only after the services have been performed or goods have been provided, regardless 
of whether the payment has already been made. The Contractor agrees that any advance 
payments authorized and paid under the terms of the Contract are not considered acceptance 
of the goods and/or services for which the payment is made. Also, payment in advance does 
not prevent Canada from exercising any or all potential remedies in relation to this payment 
or any of the Work, if the Work performed later proves to be unacceptable. 


c) Method of Payment - Advance Payment for Software Maintenance and Support for the 
Licensed Software during the Initial and Optional Contract Periods 


i. Canada will make the annual advance payment to the Contractor for the software within 30 days 
after receiving a complete invoice (and any required substantiating documentation). 

li. If Canada disputes an invoice for any reason, Canada will pay the Contractor the undisputed portion 
of the invoice, as long as the undisputed items are separate line items on the invoice and are owing. 
In the case of disputed invoices, the invoice will only be considered to have been received for the 
purposes of the section of the General Conditions entitled “Interest on Overdue Accounts” once the 
dispute is resolved. 
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lll. The Contractor acknowledges that this is an advance payment and that, despite anything to the 
contrary in the Contract, Canada will perform acceptance procedures for the goods and/or services 
only after the services have been performed or goods have been provided, regardless of whether 
the payment has already been made. The Contractor agrees that any advance payments 
authorized and paid under the terms of the Contract are not considered acceptance of the goods 
and/or services for which the payment is made. Also, payment in advance does not prevent Canada 
from exercising any or all potential remedies in relation to this payment or any of the Work, if the 
Work performed later proves to be unacceptable. 


d) Method of Payment for Task Authorizations with a Ceiling Price 


For any TA using Professional Services categories issued under this Contract, Canada will pay the 
Contractor in accordance with the following method of payment. 


For any authorized Task Authorization issued under the Contract that contains a Ceiling price: 


i. Canada will pay the Contractor no more frequently than once a month in accordance with the 
Basis of Payment. The Contractor must submit time sheets for each resource showing the 
days and hours worked to support the charges claimed in the invoice. 


Il. Canada will pay the Contractor within 30 days of receiving a complete invoice (and any 
required substantiating documentation). If Canada disputes an invoice for any reason, Canada 
will pay the Contractor the undisputed portion of the invoice, as long as the undisputed items 
are separate line items on the invoice and are owing. In the case of disputed invoices, the 
invoice will only be considered to have been received for the purposes of the section of the 
General Conditions entitled “Interest on Overdue Accounts” once the dispute is resolved. 


lil. Once Canada has paid the Ceiling price, Canada will not be required to make any further 
payment, but the Contractor must complete all the work described in the TA, all of which is 
required to be performed for the maximum TA price. If the work described in the TA is 
completed in less time than anticipated, and the actual time worked (as supported by the time 
sheets) at the rates set out in the Contract is less than the maximum TA price, Canada is only 
required to pay for the time spent performing the work related to that TA. 


9.3 Limitation of Expenditure 

a) Canada's total liability to the Contractor under the Contract must not exceed the amount set out on 
page 1 of the Contract, less any Applicable Taxes. With respect to the amount set out on page 1 of 
the Contract, Customs duties are included and Applicable Taxes are included. Any commitments to 
purchase specific amounts or values of goods or services are described elsewhere in the Contract. 


b) No increase in the total liability of Canada will be authorized or paid to the Contractor unless an 
increase has been approved, in writing, by the Contracting Authority. The Contractor must not 
perform any work or provide any goods and/or service that would result in Canada's total liability 
being exceeded before obtaining the written approval of the Contracting Authority. 


c) The Contractor must notify the Contracting Authority in writing as to the adequacy of this sum: 
l. when it is 75 percent committed, or 
Il. 4 months before the Contract expiry date, or 
lll. as soon as the Contractor considers that the contract funds provided are inadequate for the 
completion of the Work, 
whichever comes first. 
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d) Ifthe notification is for inadequate contract funds, the Contractor must provide to the Contracting 
Authority a written estimate for the additional funds required. Providing this information does not 
increase Canada's liability. 


9.4 Electronic Payment of Invoices — Contract 
The Contractor accepts to be paid using any of the following Electronic Payment Instrument(s): 


Q) 


) Visa Acquisition Card; 

) MasterCard Acquisition Card; 

c) Direct Deposit (Domestic and International); 
) 
) 


Q 


Electronic Data Interchange (EDI); 
Wire Transfer (International Only); 
f) Large Value Transfer System (LVTS) (Over $25M) 
9.5 Discretionary Audit 
C0100C (2010-01-11) Discretionary Audit - Commercial Goods and/or Services 


(0) 


9.6 Time Verification 
C0711C (2008-05-12) Time Verification 


10. Invoicing Instructions 


a) The Contractor must submit invoices in accordance with the information required in the General 
Conditions. The Contractor's invoice must include a separate line item for each subparagraph in 
the Basis of Payment provision. By submitting invoices (other than for any items subject to an 
advance payment), the Contractor is certifying that the goods and services have been delivered 
and that all charges are in accordance with the Basis of Payment provision of the Contract, 
including any charges for work performed by subcontractors. 


b) The Contractor must provide all original invoices to the Client Administrative Contact and all copies 
to the Contracting Authority. 


11. Certifications and Additional Information 

11.1 Compliance 

Unless specified otherwise, the continuous compliance with the certifications provided by the Contractor 
in its bid or precedent to contract award, and the ongoing cooperation in providing additional information 
are conditions of the Contract and failure to comply will constitute the Contractor in default. Certifications 
are subject to verification by Canada during the entire period of the Contract. 


11.2 Federal Contractors Program for Employment Equity - Default by the Contractor 

The Contractor understands and agrees that, when an Agreement to Implement Employment Equity 
(AIEE) exists between the Contractor and Employment and Social Development Canada (ESDC)-Labour, 
the AIEE must remain valid during the entire period of the Contract. If the AIEE becomes invalid, the 
name of the Contractor will be added to the "FCP Limited Eligibility to Bid" list. The imposition of such a 
sanction by ESDC will constitute the Contractor in default as per the terms of the Contract. 


11.3 SACC Manual Clauses 
A3015C (2014-06-26) Certifications - Contract 


12. Applicable Laws 
The Contract must be interpreted and governed, and the relations between the parties determined, by the 
laws in force in Ontario. 
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13. Priority of Documents 

If there is a discrepancy between the wording of any documents that appear on the list, the wording of the 
document that first appears on the list has priority over the wording of any document that subsequently 
appears on the list. 


a) the Articles of Agreement; 
b) the supplemental general conditions: 
4003 (2010-08-16) Licensed Software 
4004 (2013-04-25) Maintenance and Support Services for Licensed Software; 
2030 (2018-06-21), General Conditions - Higher Complexity - Goods: 


bj 


# 


en 


e) Annex B, Basis of Payment: 

f) Annex C, Security Requirements Check List; 

g) the signed Task Authorizations (including all of its annexes, if any); 
h) the Contractor's bid dated June 25th, 2020 


14. Insurance 
SACC Manual clause G7 005C (2016-01-28) Insurance - No Specific Requirement is hereby included as 
part of the Terms of the Contract. 


15. Safeguarding Electronic Media 


a) Before using them on Canada's equipment or sending them to Canada, the Contractor must 
use a regularly updated product to scan electronically all electronic media used to perform the 
Work for computer viruses and other coding intended to cause malfunctions. The Contractor 
must notify Canada if any electronic media used for the Work are found to contain computer 
viruses or other coding intended to cause malfunctions. 


b) If magnetically recorded information or documentation is damaged or lost while in the 
Contractor's care or at any time before it is delivered to Canada in accordance with the 
Contract, including accidental erasure, the Contractor must immediately replace it at its own 
expense. 


16. Termination for Convenience for Software Maintenance and Support Services 


Notwithstanding the Termination for Convenience provisions contained at Section 32 of 2030 - General 
Conditions - Higher Complexity - Goods, the parties agree that in the event of termination of services for 
the convenience of Canada for which an advance payment has been made, charges up to the date of 
termination will be calculated on a prorata basis of a twelve month year and a thirty day month. The 
Contractor shall immediately refund to Canada the unliquidated portion of the advance payment and pay 
to Canada interest thereon, from the date of the advance payment to the date of the refund, at the discount 
rate of interest per annum set by the Bank of Canada and prevailing on the date of the advance payment, 
plus 1% percent per annum. 


17. Limitation of Liability 

1. This section applies despite any other provision of the Contract and replaces the section of the 
general conditions entitled "Liability". Any reference in this section to damages caused by the 
Contractor also includes damages caused by its employees, as well as its subcontractors, agents, 
and representatives, and any of their employees. This section applies regardless of whether the 
claim is based in contract, tort, or another cause of action. The Contractor is not liable to Canada 
with respect to the performance of or failure to perform the Contract, except as described in this 
section and in any section of the Contract pre-establishing any liquidated damages. The Contractor 
is only liable for indirect, special or consequential damages to the extent described in this section, 
even if it has been made aware of the potential for those damages. 
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2. First Party Liability: 


VI. 


The Contractor is fully liable for all damages to Canada, including indirect, special or 
consequential damages, caused by the Contractor's performance or failure to perform the 
Contract that relate to: 


a. anyinfringement of intellectual property rights to the extent the Contractor 
breaches the section of the general conditions entitled “Intellectual Property 
Infringement and Royalties"; 


b. physical injury, including death. 


The Contractor is liable for all direct damages caused by the Contractor's performance or 
failure to perform the Contract affecting real or tangible personal property owned, 
possessed, or occupied by Canada. 


Each of the Parties is liable for all direct damages resulting from its breach of 
confidentiality under the Contract. Each of the Parties is also liable for all indirect, special 
or consequential damages in respect of its unauthorized disclosure of the other Party's 
trade secrets (or trade secrets of a third party provided by one Party to another under the 
Contract) relating to information technology. 


The Contractor is liable for all direct damages relating to any encumbrance or claim 
relating to any portion of the Work for which Canada has made any payment. This does 
not apply to encumbrances or claims relating to intellectual property rights, which are 
addressed under (a) above. 


The Contractor is also liable for any other direct damages to Canada caused by the 
Contractor's performance or failure to perform the Contract that relate to: 


a. any breach of the warranty obligations under the Contract, up to the total amount 
paid by Canada (including Applicable Taxes) for the goods and services affected 
by the breach of warranty; and 


b. any other direct damages, including all identifiable direct costs to Canada 
associated with re-procuring the Work from another party if the Contract is 
terminated either in whole or in part for default, up to an aggregate maximum for 
this subparagraph (ii) of the greater of 0.25 times the total estimated cost 
(meaning the dollar amount shown on the first page of the Contract in the block 
titled "Total Estimated Cost" or shown on each call-up, purchase order or other 
document used to order goods or services under this instrument), or $1M. 


In any case, the total liability of the Contractor under paragraph (v) will not exceed the 
total estimated cost (as defined above) for the Contract or $1M, whichever is more. 


If Canada's records or data are harmed as a result of the Contractor's negligence or 
willful act, the Contractor's only liability is, at the Contractor's own expense, to restore 
Canada's records and data using the most recent back-up kept by Canada. Canada is 
responsible for maintaining an adequate back-up of its records and data. 
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3. Third Party Claims: 


i. Regardless of whether a third party makes its claim against Canada or the Contractor, 
each Party agrees that it is liable for any damages that it causes to any third party in 
connection with the Contract as set out in a settlement agreement or as finally 
determined by a court of competent jurisdiction, where the court determines that the 
Parties are jointly and severally liable or that one Party is solely and directly liable to the 
third party. The amount of the liability will be the amount set out in the settlement 
agreement or determined by the court to have been the Party's portion of the damages to 
the third party. No settlement agreement is binding on a Party unless its authorized 
representative has approved the agreement in writing. 


ii. If Canada is required, as a result of joint and several liability, to pay a third party in 
respect of damages caused by the Contractor, the Contractor must reimburse Canada by 
the amount finally determined by a court of competent jurisdiction to be the Contractor's 
portion of the damages to the third party. However, despite paragraph (a), with respect to 
special, indirect, and consequential damages of third parties covered by this section, the 
Contractor is only liable for reimbursing Canada for the Contractor's portion of those 
damages that Canada is required by a court to pay to a third party as a result of joint and 
several liability that relate to the infringement of a third party's intellectual property rights; 
physical injury of a third party, including death; damages affecting a third party's real or 
tangible personal property; liens or encumbrances on any portion of the Work; or breach 
of confidentiality. 

lil. The Parties are only liable to one another for damages to third parties to the extent 
described in this paragraph 3. 


18. Finalization of Wave 1 Implementation Plan 

Canada will provide comments it has regarding the proposed Implementation Plan (workplan) submitted 
by the Contractor as part of its bid. The Contractor must update the Implementation Plan as requested by 
Canada within ten working days from receiving comments from the Project authority to reflect Canada’s 
comments and resubmit it to Canada for approval. This deliverable should present and detail the steps 
required to move from functional specifications, through operational go-live of the Software Solution in the 
Clients production environment, up to and including the first quarter in which the EFM Software Solution 
is available for operational use. 


19. Access to Canada's Property and Facilities 

Canada's property, facilities, equipment, documentation, and personnel are not automatically available to 
the Contractor. If the Contractor would like access to any of these, it is responsible for making a request 
to the Project authority. Unless expressly stated in the Contract, Canada has no obligation to provide any 
of these to the Contractor. If Canada chooses, in its discretion, to make its property, facilities, equipment, 
documentation or personnel available to the Contractor to perform the Work, Canada may require an 
adjustment to the Basis of Payment and additional security requirements may apply. 
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ANNEX A 


STATEMENT OF WORK 


Enterprise Fraud Management (EFM) Solution Statement of Work 


1.0 Interpretation 

Capitalized terms used herein will have the meaning set forth in Appendix 1 to Annex A — Definitions & 
Acronyms. Any term, whether capitalized or not, used in this Statement of Work that is not defined in the 
list of definitions will have the generally accepted industry, technical or trade meaning given to such term 
(if any), including any applicable meaning attributed to such term in connection with its use in the current 
release of Information Technology Infrastructure Library (ITIL) (i.e., V3, or later) (including incident 
management, problem management, release management, etc.). Similarly, unless otherwise specified, 
references to change management in this Statement of Work will have the meaning attributed to such 
term in connection with its use in the ITIL. 


1.1 Attachments 
The following Attachments are enclosed as part of this Statement of Work: 


Appendix 1 to Annex À — Definitions and Acronyms 

Appendix 2 to Annex À — IRCC Transactional Activity — Volumes 
Appendix 3 to Annex A — Indicative Business Rules 

Appendix 4 to Annex A — Resource Categories 

Appendix 5 to Annex A -IRCC High Level IT Infrastructure 
Attachment 1 — EFM Solution - Security Controls List 
Attachment 2 — Indicative Business Rules 


1.2 References to this Statement of Work to include Appendices 
Unless the context requires otherwise, references in this Statement of Work to “this Statement of Work’, 


“herein”, “hereof”, “hereunder” and “hereto” will include this Statement of Work, and the Attachments to 
this Statement of Work, collectively. 


2.0 Scope of Work 

Immigration, Refugees and Citizenship Canada (IRCC) is seeking to acquire an Enterprise Fraud 
Management (EFM) Solution to enhance the Department’s capabilities to monitor the actions of End- 
Users of IRCC IT applications in order to detect potentially inappropriate access to, or misuse of, personal 
information by those users. The solution will also alert Authorized-Users of the EFM Solution when such 
cases are detected so that they can be reviewed and investigated as required. The period of any resulting 
contract will be for three (3) years with IRCC retaining the irrevocable option to extend the contract for up 
to seven (7) additional one (1) year periods. 


The solution will be installed within the Government of Canada (GC) shared physical network owned by 
Shared Services Canada (SSC). As such, the vendor must be prepared to work with both SSC and IRCC 
personnel to install, configure, and make the solution ready for use upon contract award. As well, both 
SSC and IRCC will be responsible for the solution throughout the entire period of contract including any 
extensions. 


In order to perform its functions (e.g. monitoring, capturing, alerting, importing, and reporting), the solution 
must not require the modification, re-factoring or re-coding of any IT applications being monitored. 
Moreover, the solution must not require an agent to be installed on user end-points to gather End-User 
transactional activity. As such, managed network TAPs (Terminal Access Points) (physical and virtual) 
will be leveraged to gather End-User transactional activity (Session data). 
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The solution availability is defined as meeting the following requirements: 
a) Solution hours: 24x7 and 365 days per year basis; and 
b) Service Level: 99.5% solution wide availability excluding Client scheduled downtimes and 
unscheduled service interruptions. 


2.1 Objectives 
IRCC’s objectives in implementing the EFM Solution are to: 


a) Enhance IRCC’s capabilities to monitor, detect, and manage potential cases of malfeasance and 
misuse of information by End-Users of IRCC IT applications (referred henceforth in this document 
as “End-Users”) and alert authorized solution users (referred henceforth in this document as 
“Authorized-Users”) of the same. 

b) Meet IRCC’s EFM Solution requirements as listed in Section 3 — EFM Solution Requirements; 
and, 

c) Provide a defensible audit trail of targeted End-Users’ activities based on business rules and 
policies as defined by IRCC. 


2.2 Guiding Principles 
IRCC’s guiding principles in implementing the EFM Solution are as follows: 


a) Leverage pre-built capabilities available in the Contractor's Core Product to meet IRCC’s 
objectives and avoid customizations wherever possible; 

b) Use industry best practices in defining policies and business rules including those for monitoring, 
detecting, querying, reporting and alerting; and, 

c) Wherever possible, automate and optimize performance of the operations of the EFM Solution, 
the key interfaces with IRCC’s applications, and security systems or tools. 


The Contractor must include the above guiding principles into all designs and other work products 
wherever possible. Deviations from the guiding principles must be identified and approved in advance by 
the Technical Authority. 


3.0 EFM Solution Requirements 
The technical requirements for the Enterprise Fraud Management Solution are laid out in the subsections 


below. The Contractor must clearly demonstrate that the EFM Solution will satisfy all mandatory 
requirements listed in the subsections below. 
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3.1 Monitor, Detect and Alert 


EFM Solution Requirements 


3.1.1 The EFM solution must continually collect and monitor transactional activity of End-Users (on 
a 24/7 basis) performed through targeted IT applications. 
3.1.2 The EFM solution must have support options that include access to, on a 24 hour a day, 365 


days per year basis: 


1. On-line self-service; 

2. Phone and web based technical support: 

3. Patches and updates; and 

4. The ability to open an unlimited number of support cases. 

3.1.3 

3.1.4 The EFM solution must allow Authorized-Users to configure entities, attributes, and values 

depending on the monitored IT applications. 

3.1.5 The EFM solution must be able to reconcile time zones when capturing and importing End- 
User actions, as well as when applying detection models (e.g. user action world-wide 
recorded in UTC). 

3.1.6 The EFM solution must be capable of determining for each End-User action captured, at least 
the following information: 

1. The End-User who initiated the action; 
2. The date and time; 

3. The information viewed or edited; and, 
4. Client IT application(s) used. 


3.1.7 The EFM solution must alert Authorized-Users when there is any interruption in the collection 
of data. 


3.1.8 The EFM solution must not require re-factoring or re-coding of client IT applications to 
perform any of its functions (e.g. monitoring, capturing, importing, and reporting). 

3.1.9 The EFM solution must alert Authorized-Users when the solution fails to see data to capture 

or fails to capture any data from End-User actions performed on the targeted client IT 

applications within a pre-defined timeframe (within 10 minutes). 

The EFM solution should have the ability to integrate with other security data analysis and 

reporting tools (i.e. SIEM, DAM/DAP, DLP). The Bidder should identify all other security data 

analysis and reporting tools that the proposed solution integrates with and provide a 

description of the level of integration possible. 


3.1.11 | The EFM solution must be configurable to allow Authorized-Users to selectively turn on/off 
alerts. 


3.1.12 | The EFM solution must allow Authorized-Users to suppress alerts manually for the repeat 
occurrence of a potential incident. 

The EFM solution must be capable of distinguishing duplicate copies of user actions within 
the same transmission captured from multiple points (i.e. handling duplicates and managing it 
as only one copy). 

The EFM solution must allow Authorized-Users to receive alerts using communication 


channels inside/outside of the solution (e.g. email, text, etc.). 


3.1.15 | The EFM solution must allow Authorized-Users to customize the content of the notification 
message. 


3.1.10 


3.1.13 


3.1.14 


3.2 Business Rules 


|__| EFM Solution Requirements 


The EFM solution must allow Authorized-Users to configure and deploy business rules, and 
select and control (i.e. on, off) which client IT applications are to be targeted to have their 


End-User actions captured by the solution. 
3.2.2 The EFM solution must have the ability to monitor a single End-User or a group of End-Users 
based on pre-defined business rules. 
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The EFM solution must allow Authorized-Users, when defining an alert, to include the 
following in the alert, at a minimum: 

1. Identification#: 

2. Importance (critical, high, low); and 

3. Course of action to be executed (i.e. case type to be created, workflow). 

The EFM solution must have the capability to produce different types of configurable 
outcomes when the detection model generates an alert, including and not limited to: 

1. Trigger another detection model or rule; 

2. Create a specific case type; 

3. Flag and store in an accessible list; and 

4. Attach to an associated active case. 

3.2.5 The EFM solution must provide out-of-the-box detection model templates that can be 
modified by an Authorized-User. 
The EFM solution must provide the functionality to activate different detection models at 
various frequencies (i.e. detection models can be activated on an ad-hoc basis or scheduled 
| , event driven or other as appropriate). 
The EFM solution must allow Authorized-Users to create, modify, and delete the following 
types of business rules at a minimum: 

1. Pre-defined business rules — where an Authorized-User can only run the rule; 

2. Parameterized business rules — where an Authorized-User of the rule shall be able to 
select a specific attribute which is a variable parameter within the built rule before 
executing the rule; 

Ad-hoc business rules — build from scratch; and 

4. Custom business rules — by modifying one of the above. 

The EFM solution, when applying detection models, must be capable of applying simple and 
complex rules as well as multi-step logical scenarios (e.g. if a, and then b orc, is true, then do 
X). These rules can range from single triggers with only one condition to multi-faceted time 
sensitive triggers with many conditions or interdependencies. 

The EFM solution must provide an indicator to help Authorized-Users determine the impact to 
the solution’s performance when applying detection models (e.g. meter, elapsed time). 

If an End-Point agent is installed, the EFM solution must be able to capture session 
recordings of End-User activities. 


3.2.11 | The EFM solution must offer automated replay functionality allowing Authorized-Users to see 
the actions as performed by the End-User. 


3.3 Workflow 
| | EFM Solution Requirements 
3.3.1 | The EFM solution must provide both automated and manual workflow functionality including: 
. An Authorized-User can create a workflow manually. 
The EFM solution must allow Authorized-Users to create and store workflow types (i.e 
templates) that can be used by other Authorized-Users. 


3.3.3 | The EFM solution must allow Authorized-Users to apply and manage contextual information 
attributes) to any workflows listed in the repository. 
3.3.4 | The EFM solution must allow Authorized-Users to select, modify, and attach a workflow 
template to alerts and outcomes generated from the triggered detection models. 
3.4 Network TAPS 


EFM Solution Requirements 
The EFM solution must be able to capture transactional activity from the network TAPS 


(Terminal Access Point) between the End-User point and the client IT application, without the 
need to have anything installed on end-point devices. 
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3.5 Physical Network Taps 


| | EFM Solution Requirements 
The EFM solution must support Internet Protocol version 4 and 6 (IPv4 and IPv6). 


The EFM solution must support IPv4 and IPv6 subnets with variable-length subnet masks 
(VLSM). 


9:53 The proposed EFM solution must be compatible with both SFP+ Direct Attach (Twinax), and 
regular 10Gbps SFP+. 


3.6 Administration 

EFM Solution Requirements 

The EFM solution must provide the following minimum user-management controls: 
Allow the definition of various user roles and profiles where each role has unique, 
customizable access with a minimum of ten (10) roles for Authorized-Users of the 
solution (excludes IT access requirements); 
Allow the delegation of access; and 
Provide user groups for defining common permissions and access control. 


3./ Machine Learning 
| | EFM Solution Requirements 
3.7.1 | The EFM solution must be capable of detecting anomalies based on End-User profiles and the 

previously captured End-User actions (e.g. detect anomalies of usage when assessing a group 
of users within the same workgroup). 

-= BEM Solution PE _ _ O O 

a The EFM solution must have the capability to identify potentially new models or new patterns of 
behaviour (e.g. previous fraud activity discovered seems to always include a specific activity). 


3.7.3 | The EFM solution must have machine learning capabilities to learn based on the results 
generated and past actions taken and refine its ability to detect and flag cases based on 
patterns of user behavior, independent of defined business rules. 


3.7.4 | The EFM solution must have the capability to detect potential collusion across multiple End- 
Users of monitored IT applications. 
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3.8 Reporting 


EFM Solution Requirements 


The EFM solution must be able to apply normalization rules to the data when applying 


detection models. For example: “ST.; Rue; Str.” must be all evaluated as equivalent to 
“Street”. 


3.8.2 | The EFM solution must provide dashboard, query, and report functionality. 


3.8.3 | The EFM solution must allow Authorized-Users to query on any or a combination of entities, 


attributes, and values for any or all data that is captured, imported and appended. 


The EFM solution must allow Authorized-Users to generate, save the results, and execute 
stored queries and reports repeated! 


3.8.5 | The EFM solution must time stamp and preserve all stored queries and reports. 


ad 
O0 
— 


3.8.6 | The EFM solution must allow Authorized-Users to export query and report results 


3.8.7 | The EFM solution must allow individual users to view multiple reports, queries and dashboards 
simultaneously. 


The EFM solution must allow Authorized-Users, regardless of their desktop language settings, 
to create, generate, view and export reports in English. 

3.8.9 | The EFM solution must allow Authorized-Users to create, modify, and delete the following 
types of queries at a minimum: 


3.8.4 
.8.8 


3 


1. Pre-defined queries — where an authorized-user can only run the query; 
2. Parameterized queries — where an authorized-user of the query shall be able to select 
parameters within the built query before executing the query; 
3. Ad-hoc queries — build from scratch; and 
4. Custom queries — by modifying one of the above. 
3.8.10 | The EFM solution must allow Authorized-Users to produce the following types of reports at a 
minimum: 
1. Pre-defined reports — contents are pre-defined; 
2. Parameterized reports — pre-packaged report of the results generated within the 
parameters set: 
3. Ad-hoc reports — build a report from scratch; and 
4. Custom reports — by modifying one of the above. 
The EFM solution must allow Authorized-Users, when using a parameterized query, to: 
1. Add alist of values within a specific parameter (e.g. list of account numbers or names) 
for the query to be performed on; and 
2. Specify full or partial parameters to execute a query (e.g. use wildcards). 


3.8.12 | The EFM solution must be able to keep a record of all captured End-User actions supporting 
potential cases of information malfeasance and misuse over a user configurable time period of 
at least 6 years. 


3.8.13 | The EFM solution must have the functionality to export all case information created in the 
solution. 


3.8.14 | The EFM solution must have the functionality to maintain the chain of custody as per the 
existing regulations including Rules of Evidence and the Canada Evidence Act (https://irb- 
cisr.gc.ca/en/legal-policy/legal-concepts/Pages/EvidPreuApp.aspx). 

3.8.15 | The EFM solution must allow Authorized-Users, regardless of their desktop language settings, 

to create, generate, view and export reports in French. 

3.8.16 | The EFM solution must allow Authorized-Users to display the information in the following 

formats: 

1. Tabular; 
Graphical (e.g. bar; pie; 3D); 


3.8.11 


2. 
3. Textual; and 
4. Advanced graph types (e.g. overlays, bubble charts). 
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3.8.17 | The EFM solution must allow Authorized-Users to customize reports: 
1. Page numbering; 
2. Sorting and grouping; 
3. Data arrangement (e.g. change physical location of data within the report); 


4. Orientation (e.g. portrait v. landscape); or 
5. Style, colour, font, size, italics, bolding, and underlining. 


3.8.18 | The EFM solution must allow Authorized-Users to create queries and reports using the 
following: 
1. “Drag and drop’; 
2. ‘Click and choose’; 


3. Manual entry; and 
4. Native query type language such as SQL. 
3.8.19 | The EFM solution must provide context querying that enables users to “drill-through’ to details. 


3.8.20 | The EFM solution must allow Authorized-Users to generate, view and export reports in English 
or French. 


3.8.21 | The EFM solution must allow multiple users to view the same report at the same time. 
3.8.22 | The EFM solution must allow multiple users to execute the same query simultaneously. 


3.8.23 | The EFM solution must allow Authorized-Users to select output report formats including but 
not limited to: 
1. CSV; 


2. Tab delimited text files; and 


EFM Solution Requirements 
The EFM solution must support search and retrieval capabilities of data it has archived. 

EFM Solution Preferences 

9.2 | The EFM solution must allow a fuzzy search on data collected. 

9. The EFM solution must provide ranking of search results when searching on any ora 
combination of entities, attributes, and values within the solution data repository. 
The EFM solution must provide case-insensitive (i.e. does not distinguish between upper and 
lower case data) search capabilities. 


3.10 General Requirements 

|__| EFM Solution Requirements 

3.10.2 | The EFM solution must be a commercially available end-to-end solution allowing authorized- 
eu users to seamlessly activate multiple modules while maintaining common look and feel 


throughout a session. 
3.10.3 | The Contractor must provide all proposed EFM solution documentation, including user 
manuals and administration manuals in English. 
3.11 Scalability and Load Balancinc 


| | EFM Solution Requirements 
3.11.1 | The EFM solution must accommodate a monitoring volume of transactions as identified in 
Annex B — IRCC Transactional Activity - Volumes in the SOW document. 


Refer to Attachment 1 — EFM Solution — IRCC High Level IT Infrastructure document for 
additional details. 


3.11.2 | The EFM solution must be scalable by leveraging Client-approved infrastructure to meet 
increase in service demand. 
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3.12 On-premise Hosting 
| | EFM Solution Requirements 
The EFM solution must support running in the following virtualized environments: 
1. Microsoft Hyper-V; and 
2. VMWare vSphere; 


3.12.2 | The EFM solution must be capable of being entirely contained within the client IT network and 
not depend on or require data external to the client IT network. 


| | EFM Solution Preferences 
3.12.3 | The proposed EFM solution must never communicate outside of the client IT network for any 
reason unless specifically authorized by the client technical authority). 
3.13 Security 
EFM Solution Requirements 


3.13.1 | The EFM solution must be able to work with full functionality within an environment that uses 
encrypted transmissions. 


The EFM solution must offer the capability to encrypt communications with other systems 
using Communications Security Establishment (CSE) approved algorithms. 

The EFM solution must support CSE approved secure transmission protocols including but 
not limited to SSL, TLS, HTTPS (i.e. SSL over HTTP). 

3.13.4 | The EFM solution must comply with Information Technology Security Guidance-22 (ITSG-22) 
that applies to Protected B information. “Baseline Security Requirements for Network 
security Zones in the Government of Canada’. 
http://www.cse-cst.gc.ca/documents/publications/itsc i .p 


df 
3.13.5 | The EFM solution must support, at a minimum, API level authentication for integration with 
other client IT systems. 
3.13.6 | The EFM solution must be able to monitor transactions that are using 2-factor authentication. 
EFM Solution Preferences _ 


| | EFM Solution Preferences 
3.13.7 | The EFM solution must separate, logically or physically, user interface from system 
management interface. 


period set for the account by the Authorized-User. 
Authorized-User. 


defined by the client, before granting access. 
minutes. 


3.13.13 | The EFM solution must force the users to re-authenticate after a set inactivity period. 


3.13.14 | The EFM solution must terminate the client network connection at end of session or after a 
period of inactivity not exceeding 60 minutes. 


3.13.15 | The EFM solution must enforce segregation of duties and authorization through 
authenticated user accounts. 


3.13.16 | The EFM solution must allow a configurable number of access privileges for each role. 
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The EFM solution must provide a logging functionality to track actions including create, modify, 
disable, query and report on any entity or record and capture at a minimum the following 
actions: 

1. Date and Time of the action (including time zones); 

2. Action by; and 


3. Action taken. 
| | EFM Solution Preferences 


3.14.2 | The EFM solution must uniquely identify and authenticate users or processes acting on behalf 
of users. 

3.14.3 | The logs captured for all activities performed by Authorized-Users of the EFM solution must be 
read-only. 


3.15 Technical 
-EFM Solution Requirements O o y S 
The EFM solution must support, at a minimum, a web interface on one of the following: 
1. Internet Explorer 11 or higher; 
2. Google Chrome 72 or higher; 
3. Firefox 70 or higher. 
The EFM solution must perform all user authentications using Client LDAP Directory. 
3.15.3 | The EFM solution must allow only Authorized-Users with specific permissions to delete any 
data. 
3.15.4 | The EFM solution must include test environment to allow Authorized-Users to: 
1. Apply detection models in a variety of operating modes; 
2. Runina simulation mode (e.g. against data already collected generating simulated 
alerts without generating live detection alerts); and 
3. Test patches and updates in a non-production environment. 


Event Management [SIEM] systems. 
EFM Solution Preferences 


3.15.7 | The EFM solution must allow Authorized-Users, regardless of their desktop language 
settings, to operate web interface in either official language of Canada. 

3.15.8 | The EFM solution must allow cancelled actions, finished processes and sessions to 
terminate in a clean manner leaving no inconsistent, damaged or temporary files. 

3.15.10 | The EFM solution must have the ability to auto-purge data based on pre-defined data 
retention settings and upon Authorized-User confirmation. 


3.15.11 | The EFM solution must allow Authorized-Users to mark data as “do not delete”. 
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3.16 Case Management 


[ERM Solution Preterences LLL 
and attach all relevant data associated with the incident. 

3.16.2 | The EFM solution should have the capability to export all data, information, captured 
information, and reports to other case management systems for the purpose of data 
migration. 

The EFM solution should have the capability to attach a potential case occurrence to an 
associated active case when a business rule(s) generates an alert. 

3.16.4 | The EFM solution should allow Authorized-Users to export data to the following file formats: 

1. Office Open XML; 
2. XML; and 
3. Tab delimited text files. 
The EFM solution should allow Authorized-Users to import/export audio, video and at least 
one pictorial format (e.g. jpg, gif, png). 


and change risk level of potential cases. 
The EFM solution should have the capability for Authorized-Users to configure risk levels for 
a case (e.g. by volume, business rule, users, time). 


3.16.8 | The EFM solution should provide both automated and manual case management 
functionality including: 
1. An Authorized-User can create a case manually; and 


2. Acase can be automatically created as part of a workflow or outcome of a detection 


3.16.9 | The EFM solution should allow Authorized-Users to create, modify, and store case types (i.e. 
templates) that can be selected and used by other Authorized-Users. 


model. 
For example: 
1. The outcome of applied analytics; or 
2. Aclient submits a request for information. 


The EFM solution should allow Authorized-Users to apply and manage contextual 
information (attributes) to any case types and case reports listed in the repositor 

The EFM solution should allow Authorized-Users to select, modify, and attach a case 
template to alerts and outcomes generated from the triggered detection models. 


3.16.12 | The EFM solution should add system generated information to each case as it is created 
including but not limited to: 


1. A unique case ID; and 
2. Date created. 


3.16.13 | The EFM solution should allow Authorized-Users to work a case to completion. 
Example steps: 

1. Accept, refuse or re-assign; 

2. Prioritize: 
. Update the status: 
. Track task(s); 
. Add text (information); 
. Attach documents (e.g. PDF, MS Word, jpg); 
. Invoke escalation process; 
. Set notifications; or 
. Export and/or print all or part of the case information. 
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2.46 14 The EFM Solution should provide. Author zed: Users the ca pabiliivte list on guenvonanyionen 16.14 | The EFM solution should provide Authorized-Users the capability to list or query on any open 
or closed cases. 


3.16.15 | The EFM solution should allow Authorized-Users to create a case report template that can be 
selected and completed by other Authorized-Users as required to communicate the results of 
a case (e.g. case result reports; form letters). 


3.16.16 | The ay solution should be able to send a notification (e.g. email) when the recipient of an 


assigned case is setup as an occasional user within As access This profile will be 
used for occasional Authorized-Users (e.g. employee supervisors) who are required to 
review and action a case. 
3.16.17 | The EFM solution should allow Authorized-Users to manage their workloads, for example: 
1. Lists their assigned cases; 
2. Ability to drill into any case; or 
3. List the due dates. 


3.17 Maintenance 
| | EFM Solution Preferences 


3.17.1 | The EFM solution must have the ability to display system messages at login. 


4.0 Wave 1 EFM Solution Implementation 

The Contractor must analyze, design, install, test and support the production implementation of the EFM 
Solution for Wave 1, defined as the implementation of an EFM Solution to monitor, detect, notify and 
capture potential passport information misuse and malfeasance by End-Users of IRCC’s Global Case 
Management System (GCMS) passport application. The Contractor must provide its own methodology, 
tools and assets to achieve an operational Wave 1 EFM Solution within the timeframe described in 
section 7 — Schedule. The Contractor must identify its activities and deliverables in its methodology and 
Project Plan including, at a minimum, the activities described in the subsections of Section 4 directly 
below as well as the deliverables (or their equivalents) identified in Section 6.2 of this document. 


4.1 Project Management 
The Contractor must provide Project Management services to plan, schedule, monitor and report on the 
Wave 1 EFM Solution Implementation to achieve the Wave 1 requirements within the proposed schedule, 
cost and scope. Project Management activities must include, but are not limited to: 
a) Develop a project schedule, work breakdown structure (WBS) and assignments for each WBS 
element: 
) Establish Project Management tools, templates, communication methods and best practices; 
c) Develop a Resource Management Plan (including Client resources): 
d) Provide and execute Risk Mitigation strategies and actions; 
e) Provide Weekly Status Reports; 
f) Develop Upfront Deliverable Agreements (UDAs) to set expectations of the content, form and 
acceptance criteria of each deliverable; 
) Develop Quality Assurance Strategy and formulate a Quality Assurance Plan; 
) Develop a Transition to Operations Plan; 
Direct & manage project execution; 
j) Collaborate with IRCC’s Project Management team and Subject Matter Experts (SME); 
k) Participate in the defined governance structure; and, 
I) Perform contingency planning. 
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4.2 Define and Analyze 
The Contractor must review and analyze IRCC’s EFM Solution requirements for Wave 1. This must 
include, but is not limited to: 


a) Validate, modify and/or develop as required IRCC’s Wave 1 EFM use cases and business rules 
and compare to industry best practices; 
b) Validate as required IRCC’s Wave 1 EFM business requirements, and objectives and compare to 
industry best practices; 
c) Validate, modify and/or develop as required technical requirements for the EFM Solution; 
d) Identify and analyze gaps; and, 
) Recommend options to address the gaps. 


4.3 Design 
The Contractor must provide business and technical designs of the EFM Solution for Wave 1. This must 
include, but is not limited to: 


a) Plan, organize and facilitate interviews and group workshops to obtain and gain agreement on a 
solution for the functional and non-functional requirements; 

b) Develop Design Specifications for any technical components identified such as Reports, 
Interfaces, Conversions, Extensions, Forms and Workflows to produce and implement a system 
that satisfies IRCC’s EFM requirements for Wave 1. Both business and technical components are 
considered as part of Design activities; 

c) Develop recommendations for IRCC to create, refine, or eliminate business processes as 
applicable to enhance the EFM capabilities; and, 

d) Develop an Integrated logical architecture design model of subsystems, components, interfaces, 
key data entities, and business processes that comprise the EFM Solution. 

e) Complete the Security Requirements Traceability Matrix (SRTM) as part of the Security 
Assessment and Authorization (SA&A) process (to be completed in collaboration with IRCC IT 
security Risk Management group). 


4.4 Build 
The Contractor must install and develop the EFM Solution for Wave 1 in a development / test 
environment. This must include, but is not limited to: 


a) Translate designs and specifications into automated and non-automated technical components 
that meet Wave 1 requirements for the EFM Solution; 

b) Perform application administration functions as required to support development activities; 

c) Provide dedicated non-production environments for development (DEV) and testing (TEST) 
during implementation of the EFM Solution, and ensure that these remain available to the Client 
after the solution is implemented; 

d) Install and configure the EFM Solution, including integration activities with IRCC’s LDAP system, 
databases and network components: 

e) Develop agreed upon custom components or code; 

f) Configure the Core Product with business rules and policies to satisfy the Wave 1 requirements; 
and, 

g) Advise IRCC in developing business processes, templates and procedures related to the EFM 
solution. 
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4.5 Quality Assurance 
The Contractor must perform quality assurance on the EFM Solution to ensure all Wave 1 business and 
technical requirements are proven to be successfully met. This must include, but is not limited to; 


a) Define and execute tests to validate the EFM Solution and business rules in non-production 
environments (development / test) through testing of: 
i. Business requirements 
ii. Technical requirements 
lil. Use cases 
IV. system performance 
V. System integration 
vi. security 
b) Remediate defects in the EFM Solution until such time as business and technical requirements 
have been proven to meet IRCC’s acceptance criteria as defined in Section 6.1 — EFM Solution 
Acceptance; and, 
c) Support IRCC in performing and documenting User Acceptance Testing. 


4.6 Optimize 
The Contractor must optimize the EFM Solution. This must include, but is not limited to: 


a) Validation of the EFM Solution Implementation Checklist, completion of IRCC requirements, and 
confirmation that the system is ready for implementation; and, 

b) Optimize and address any required modifications in terms of the overall EFM Solution. Business 
processes, databases, and network components are further tested and fine-tuned for 
performance. Critical software and architectural components are improved for reliability, 
adaptability, and other technical considerations. 

c) Participate in documenting of the Authority to Operate (ATO) security authorization process as 
part of the SA&A. 


4.7 Deployment 
The Contractor must provide support services to assist IRCC in the deployment of the EFM Solution into 
production for Wave 1. This must include, but is not limited to: 


) Train IRCC resources as described in Section 4.9 — Training; 

b) Support the deployment of the EFM Solution to the production environment with minimal 
disruption to IRCC’s business environment; 

) Advise IRCC of any modification to the production environment required for the EFM Solution; 

) Support the Technical Authority's acceptance for deployment of the EFM Solution into production; 
and, 

e) Provide a post deployment review and recommendations. 


4.8 Post-Deployment Stabilization and Optimization 

Post-Deployment Stabilization and Optimization describes the ongoing activities to support the EFM 
Solution until such time as the EFM Solution has been accepted (see Section 6 — Deliverables and 
Acceptance Criteria). These activities and responsibilities occur for each release and will be governed by 
IRCC’s acceptance process and criteria and the Contractor's warranty as per the Agreement between 
Contractor and IRCC. 


As part of Post-Deployment activities, Contractor must transition the support and operations of the EFM 
solution to IRCC and/or any other Contractor that IRCC appoints for the Support and Maintenance 
Services. 
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For greater clarity, the Contractor is expected to support and maintain each release of the EFM Solution 
until such time as all releases have satisfied IRCC’s acceptance process and criteria. The support and 
maintenance activities primarily include: 


a) Resolution of all post-deployment issues relating to the EFM Solution’s configuration or technical 
component; 

b) Root Cause analysis and documentation of all EFM Solution related issues identified, and 
resolutions provided post-deployment; and, 

c) Providing fixes for Core Product or customization defects and issues identified post-deployment. 


4.9 Training 

The Contractor must provide onsite classroom-based training for EFM Solution architects, administrators 
and users. The Client reserves the right to review and approve course material and training plan prior to 
training and material distribution. The training must be available in both French and English sessions. The 
training sessions will be provided in the National Capital Region. The training must cover, at a minimum, 
the following topics: 


Architecture and System Administration 


EFM Solution physical and logical implementation architecture options and best practices; 
Physical and logical sizing and tuning best practices; 

Archiving; 

Installation, configuration and customization options; 

Import, export and integration methods, options and best practices; 

system monitoring methods and best practices; 

Installation of upgrades and patches; and, 

User and role administration, security and permissions methods and best practices. 


QD OO TY 
wee es es 


N” Se” 


Business Rule Configurations 


a) Review of out-of-the-box business rules that are included with the Commercial Off-the-Shelf 
(COTS product); 

b) Methods and best practices for configuring, testing and implementing business rules for the 
monitoring, detection, capture and alerting of information misuse and malfeasance; and, 

c) Administration of business rules, including editing, copying, disabling, pausing and re-starting. 


EFM Solution Authorized-Users 


) Overall navigation, user features and functions of the EFM Solution; 

b) Review of reporting and dashboard functions, including report/dashboard creation, viewing, 
modification, deletion and auto-generation/recurrence; 

c) Review of case management functions, including case and workflow creation, viewing and 
modification; 

d) Search functions; and, 

e) Methods and best practices for the following incident management functions: 


i. Receiving and actioning of alerts; 
Il. Creating an incident case; 
lil. Working within a case; 
IV. Reviewing monitored and captured information regarding an incident; and, 
V. User and case permissions. 
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Training is required for the following numbers and types of resources (referred to collectively in the EFM 
Statement of Work as “authorized-users’): 


IT Architects — 8 
IT Administrators — 8 
Security Analysts (i.e. business rule configurations) — 14 


a 
b 
C 
d) Case Investigators — 72 


) 
) 
) 
) 


All training described above is to be provided onsite at a designed Government of Canada (GC) provided 
facility and scheduled at a mutually agreeable time with the Technical Authority at least two weeks in 
advance of the course start date. The GC will provide all classroom facilities. 


The Contractor agrees to provide Canada electronic and hardcopy training materials in English and 
French. The Contractor grants the Client a non-exclusive license to use, copy, translate and distribute all 
such materials for the Period of the Contract and for the sole benefit of the Client. 


5.0 Professional Services 

For work within the scope of the deployment and configuration of the EFM Solution, that is not otherwise 
covered in Section 4 — Wave 1 EFM Solution Implementation, the Contractor must provide the services 
outlined below on an as and when requested basis, during the entire term of the contract, including any 
extensions exercised as Options by the Contracting Authority in accordance with the Contract. The work 
will be requested through a Task Authorization or Contract Amendment. GC may, at its sole discretion, 
contract for any goods or services with other contractors for these Additional Services. 


All resources must hold a valid Reliability Status clearance as indicated in the Security Requirements 
Check List (SRCL). 


The following professional services categories must be available through the TA process for all estimating 
activities and subsequent performance of the Additional Professional Services: 


a) Project Manager 

b) EFM Solution Architect 

c) EFM Policy / Business System Analyst 
d) System Administrator 

e) Technical Architect 

f) Programmer / Developer 

g) Database Analyst 

h) Training Specialist 


QA Analyst 
Testing Specialist 


t : 


For each of the above roles, additional details on the required levels of experience and the responsibilities 
of the role are available in Appendix 4 to Annex A — Resource Categories. 


6.0 Deliverables and Acceptance Criteria 
6.1 EFM Solution Acceptance 
The Wave 1 Implementation will be deemed accepted once the following has occurred: 


a) All deliverables identified in the agreed-upon project plan have been delivered and accepted in 
accordance with the agreed-upon deliverable specifications and acceptance criteria. Deliverables 
must include all deliverables identified in Section 6.2 — Deliverables or their equivalents; 

b) The security control requirements identified in Attachment 1 — EFM — Security Controls List, must 
be met for the EFM Solution. The Contractor is required to ensure the EFM Solution meets all 
security controls prior to implementation; 
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c) The EFM Solution has successfully passed User Acceptance Testing (UAT) in the testing 
environment, has been deployed in production and is successfully operating in such a manner as 
to meet all requirements identified in the approved Wave 1 Business and Technical requirements; 
and, 
d) All Wave 1 Training has been completed. 
6.2 Deliverables 
The Contractor is expected to develop the following deliverables over the course of the EFM Solution 
Implementation Project. The Contractor must provide all deliverables to Technical Authority for review and 
approvals. 
Milestone / Description Forecast 
Deliverable (Business days 


from Contract 
award date) 


*Contract Award* © Dayo, 


Milestone Technical Team engagement with Supplier No later than 20 
days from 

Contract Award 

Project Plan including Schedule and Work Breakdown No later than 20 
Structure (WBS) days from 

Contract Award 


Deliverable Risk Mitigation Strategies and Plan No later than 20 
days from 
RE Award 


Deliverable Weekly Status Reports = Ongoing | 


Milestone Start development of the solution No later than 40 
days from 

Contract Award 

Deliverable Deliverable Specifications and Acceptance Agreements No later than 40 
(Upfront Deliverable Agreements (UDAs)) days from 


Contract Award 


Deliverable Gap Analysis and recommendations to address gaps, if No later than 40 
applicable days from 
Contract Award 


Deliverable Complete Security Requirements Traceability Matrix No later than 40 
(SRTM) — in consultation with Client. days from 


Contract Award 


Deliverable Interview / workshop Schedule / plan No later than 40 
Contract Award 

Deliverable Technical Solution Design No later than 40 
days from 

Contract Award 

Deliverable e Technical Configuration Document No later than 130 
Contract Award 

Deliverable e Development Plan, if applicable No later than 50 
Contract Award 

Deliverable Configuration of business rules as defined in use cases. No later than 90 
Contract Award 
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Deliverable e Technical Design documents for reports, integrations, No later than 130 
customizations, extensions and workflows, if applicable days from 
Contract Award 


Deliverable e Training manuals No later than 100 
days from 

Contract Award 

Deliverable e Training schedule No later than 100 
days from 

Contract Award 

days from 

Contract Award 

Milestone Integration of use cases and reports No later than 120 
days from 

Contract Award 

Milestone Testing/validation of final solution use cases and reports No later than 120 
days from 

Contract Award 

Deliverable e Test Cases and Scripts No later than 120 
Contract Award 

Deliverable e Configured Test Environment for end-to-end solution No later than 120 
Contract Award 

Milestone Approved Transition Plan No later than 110 
days from 

Contract Award 

Milestone Pilot testing and remediation No later than 120 
Contract Award 

Deliverable e Test Results and Defect Log No later than 120 
days from 

Contract Award 

Milestone Necessary Privacy and Policy updates are completed No later than 120 
days from 

Contract Award 

Milestone Training of Workplace Investigations and Ethics (WIE) No later than 100 
days from 

Contract Award 

Milestone Stakeholder evaluation/approval to proceed No later than 110 
days from 

Contract Award 

Milestone Finalization of the solution No later than 130 
days from 

Contract Award 

Milestone Complete development of the solution No later than 130 
days from 

Contract Award 

days from 

Contract Award 

days from 

Contract Award 
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Deliverable e Deployment Test Results No later than 130 
days from 

Contract Award 

Deliverable e Configured Production Environment No later than 130 
Contract Award 

days from 

Contract Award 

Milestone Start solution implementation No later than 140 
days from 

Contract Award 


Milestone Completed full Implementation of the solution No later than 140 
days from 

Contract Award 

Milestone Evaluation/Remediation and update of use cases/reports No later than 160 
days from 

Contract Award 

days from 

Contract Award 


Deliverable e User (business) manuals No later than 160 
days from 
Contract Award 


Wave 1 Implementation Project Close-Out Report Within 160 days 


6.3 Deliverable Acceptance 

Prior to the development of any deliverables, the Contractor must provide an Upfront Deliverable 
Agreement (UDA), where deemed necessary by the Technical Authority, that must contain a proposed 
deliverable specification and acceptance criteria. The discussion on UDA content will continue between 
the Contractor and Technical Authority until approved. Once approved, the UDA will form the acceptance 
criteria for the deliverable. 


In addition to the specific acceptance criteria described in each UDA, deliverables must be evaluated for 
the following attributes: 
Description 
Document Format Consistent format is used; 
and Clarity Correct and continuous section numbering is used; 
Material is presented logically; 
Non-standard terms, phrases, acronyms, and abbreviations are defined; 
Consistent titles and labels on figures are used; 
No ambiguous statements or content are used; 
Use of passive voice is minimal and appropriate ; 
No typographical errors, spelling errors, missing words, or incorrect page 
and section numbers; 
Generally accepted rules of grammar, capitalization, punctuation, 
symbols, and notation are used; and, 
Cross-references are identified appropriately and accurately. 
Alignment and Terms have the same meaning throughout all project documentation; 
Consistency The material does not contradict predecessor documents e.g. If the 
Deliverable contains requirements, they align with IRCC business needs 
as defined in Section 3 — EFM Solution Requirements; 
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All material in subsequent documents has a basis in the predecessor 
document, for example: 

i. If the Deliverable contains designs, the design addresses the 
defined requirements or specifications; 

ii. If the Deliverable contains a solution deployed on IRCC 
infrastructure, all non-functional requirements have been 
validated and the solution is consistently performing at the 
agreed performance targets; and, 

If the Deliverable contains a solution deployed on IRCC 
infrastructure, all applicable use cases have been successfully 
validated and the solution is consistently meeting all functional 
requirements regardless of the employee activities or data 
inputs. 


Completeness If the Deliverable contains a plan or a process, it is clear who is 
responsible for which task, when the plan or process is planned to be 
completed, and how the plan or process will be evaluated and 
determined to be successful: 

If the Deliverable contains business or technical designs or 
specifications, all elements of the design are complete and clear so that 
readers understand the related functionality that will be developed; 

If the Deliverable contains requirements, specifications, or success 
criteria, they include specific metrics against which achievement can be 
measured. They are clear enough to be used in the development of 
future Deliverables (for example, the requirements are written clearly 
enough to aid in the writing of use cases and success criteria); and, 

If the Deliverable contains findings and recommendations, the 
Deliverable clearly states how these were developed. 


7.0 Schedule 

The Wave 1 EFM Solution must be in production and accepted within two hundred (200) business days 
following contract award. This includes the completion and acceptance of all Contractor activities and 
deliverables as defined in Section 4 — Wave 1 EFM Solution Implementation, with the exception of Post- 
deployment Stabilization and Optimization ongoing activities to support the EFM Solution until such time 
as the EFM Solution has been accepted. 


schedules for future waves have not yet been defined. 

8.0 Governance Framework 

The successful completion of the Project requires a concerted and coordinated effort between IRCC, 
Shared Services Canada (SSC) and the Contractor. IRCC is the accountable lead for the overall project. 
This section describes the existing project governance structure and the Contractor's responsibilities 
within it. 

The following Project governance structure has been established to ensure timely and effective oversight, 
information sharing and decision making. The Contractor must support the project governance as defined 
below. 


The Projects governance structure consists of the following committees: 
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Senior Project Advisory Committee: The ADM-level committee oversees multiple projects and provides 
leadership, vision and strategic direction to those projects. It advocates on behalf of projects to enable 
specified business outcomes and benefits in alignment with the respective programs and Government of 
Canada priorities. 


Project Oversight Committee: The Project Oversight Committee (POC) is a decision-making body at 
the Director General level that supports IRCC’s Priorities and Investment Committee in ensuring that 
projects adhere to Treasury Board Secretariat (TBS) project management policies and standards, and 
IRCC’s project management directives, standards and best practices. The role of the POC is to manage 
project portfolios, and approve all project gates and business outcome assessments. 


Senior Review Board: The Senior Review Board (SRB) supports the Director General leads for the 
Project Management Board (PMB). The role of the SRB is to provide Director General level review, 
oversight, support, and guidance for the long-term Enterprise Fraud Management Solution Director 
General lead(s) to assist in the successful award and implementation of the long-term Solution and 
Contract. Individual members of the SRB are selected based on their specific areas of subject matter 
expertise, experience and insights from lessons learned or best practices. 


Project Management Board: The Project Management Board (PMB) is the Project's primary 
interdepartmental oversight forum. PMB is responsible for ensuring a coordinated approach for delivering 
the Project. It is comprised of Director level representatives. PMB helps to ensure that the business, 
technical and service delivery teams are working towards common goals and objectives. 


GCMS Privacy Mitigation Measures Working Group: The Global Case Management System (GCMS) 
Privacy Mitigation Measures Working Group (GCMS PMMWG) is a working level committee that is 
accountable to the PMB. The GCMS PMMWG will provide an opportunity for the project members to 
discuss cross team progress and issues for resolution within the team or for escalation to the Project 
Management Board (PMB). Moreover, the GCMS PMMWG will provide leadership control and project 
oversight to ensure that the delivery and implementation of the project products occur in alignment with 
the schedule, project dependencies, milestones and the approved budget for each individual Work 
Package. 


Ad-Hoc Working Groups: The ad-hoc working groups will provide a forum for brainstorming on various 
matters with key stakeholders during the development and implementation exercise of the EFM Solution. 
These working groups will be led by the systems business owner who is the Information Systems Security 
Officer (ISSO). 


Within this governance framework, ad-hoc Working Group meetings can be established (involving the 
Contractor and key project stakeholders) in support of the EFM solution development and implementation 
activities such as: 

a) Project Schedule; 


b) Activities completed, delayed and underway; 

c) Key issues and proposed resolutions; 

d) Key risks and mitigation strategies; 

e) Key decisions made or requested; 

f) EFM Solution demonstrations (as deemed required by the Client). 


The Contractor is required to participate in ad-hoc Working Group meetings, on an as needed basis, in 
person to present the above material and participate in Q&A. If in person attendance is not possible, 
attendance is required via video or teleconference. 
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legend 


Figure 1 - Governance Framework 


9.0 Client Support 
IRCC will provide access, in a mutually agreed timeframe, to departmental personnel, boardrooms and 
meeting rooms, and relevant documentation. 


10.0 Travel 

Travel to, from or within the National Capital Region (NCR) will not be reimbursed. 

All other travel expenses to visit Government of Canada facilities or resources must have the prior 
authorization of the Technical Authority and will be reimbursed in accordance with the Treasury Board 
Travel Directive. 


11.0 Language 

The primary language of work is Canadian English however work may be conducted in either Official 
Language (Canadian English and/or Canadian French). The deliverables (presentation and written report) 
must be in Canadian English. The in-person presentation shall be given in either Canadian English or 
Canadian French, as required. Any translations of materials specifically developed in the performance of 
this contract shall be the responsibility of the Project Authority. Any reports must be written according to 
The Canadian Style: A Guide to Writing and Editing (2nd edition) and submitted in MSWord format. 


12.0 Work Location 

All work related to this contract must be performed onsite at a designated Government of Canada site 
located in the National Capital Region or approved Contractor site in accordance with the SRCL attached 
to this contract. 


13.0 Limitations and constraints 

The Contractor must be ready to work with the Project Authority and other departmental personnel as 
required. Meetings between the Contractor and the Project and Technical authorities will be held at IRCC 
facilities located in the National Capital Region between the hours of 9 am and 5 pm, Monday to Friday. 


The Contractor must keep all documents and proprietary Crown information confidential and return all 
materials, including documents and files, belonging to IRCC upon completion of the contract to IRCC. 
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All work performed will be subject to inspection and acceptance by the Project Authority. The Project 
Authority will make every effort to complete inspection and acceptance within 5 working days of delivery, 
however should IRCC not meet this time frame corresponding extension of the project schedule will be 
permitted based on IRCC’s delay. All draft and final documents will be approved by the Project Authority 
prior to distribution. Should the work not meet the expectations of the Project Authority, the Contractor 
must re-submit revised (acceptable) work at no additional cost to IRCC. 


14.0 Reporting and Communication 

In addition to the timely submission of all deliverables and fulfillment of obligations specified within the 
Contract, it is the responsibility of the Contractor to facilitate and maintain regular communication with the 
Project Contact(s). Status updates, verbal or written, must be delivered on a regular basis over the course 
of the contract. Communication is defined as all reasonable effort to inform all parties of plans, decisions, 
proposed approaches, implementation, and results of work, to ensure that the project is progressing well 
and in accordance with expectations. Communication may include: phone calls; electronic mail; and 
meetings. The Client will schedule recurrent meetings or bilats with the Contractor to discuss any issues, 
problems or areas of concern over the course of the contract. 
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Appendix 1 to Annex A — Definitions and Acronyms 


The table below summarizes the terms and their definitions as used within the Enterprise Fraud 
Management (EFM) Solution documentation including all referenced Appendices, Attachments and 
Enclosures. 
Additional Onsite Training Refers to Contractor provided training at a GC provided facility that 
is over and above that training required in Section 4 — Wave 1 EFM 


Solution Implementation and may include any or all of the training 
services identified therein. 


Authorized-User Refers to any person who has been granted a user account, 
including privileged access, to the EFM solution. 


Business Rule Under this requirement, business rules govern the EFM alerts and 
notifications. In the case of the EFM Solution, acceptable behaviour 
will be identified and tracked and everything else will be flagged for 
investigation. 

A process to acquire the transactions generated by End-Users 
ing targeted IT applications and manipulating information. 
or notification 


Case Report A conclusion, findings or results post completion of a case. 


Case Type The specific classification of a case which usually includes a 
specific workflow and set of rules that govern an incident, alert or 
notification. 

Refers to the GC branch(es) or department(s) procuring, 
administering, or operating the EFM Solution. 

Refers to EFM Solution users accessing the EFM Solution 
simultaneously. 


Configuration Refers to an arrangement of elements in a particular form, or 
combination which includes minor physical or software setting 
changes that can be implemented without custom physical 
modifications or changes to the base code. Configuration may 
include Installation. 

Contract, Master Services Agreement | Refers to the written Contract entered into by IRCC and Successful 

(MSA) Contractor for the delivery of the requirements listed in Enclosure 
F.1 — Statement of Work. Within the contract term, IRCC may 
potentially issue task authorization call ups for additional services 
related to EFM Solution and/or services. 


initial bid. 

Refers to the EFM Solution in its COTS form (i.e. prior to any 
customization for IRCC implementation). 

Refers to the primary project team members of both the client and 
contractor. 

Refers to Designated members of the corporate security team 
responsible for security related investigations. 

Customization Refers to the modification of EFM Solution base code to meet 

IRCC’s EFM Solution requirements. 
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Database Activity Monitoring 
(DAM)/Database Audit Protection 


A technology identified as, Database Activity Monitoring 
(DAM)/Database Audit Protection (DAP) technologies that is used 
to monitor database administration activity and database user 


(DAP) 


access. 

An easy to read, single page data visualization tool comprised of 
graphics, charts, gauges and other visual indicators. 

The process of reading and storing any actions as performed by an 
End-User using an IRCC asset (i.e. targeted application). 

Data Loss Prevention (DLP) A technology identified as, Data Loss Prevention (DLP) that is used 

to detect and prevent the inappropriate storage and movement of 
sensitive data. 


Drill-through The means by which an Authorized-User can move horizontally 
between two items (e.g. accessing and viewing relevant and related 
data in other reports by passing context from a source to a target 
report). 


Electronic Data Warehouse (EDW) Refers to IRCC’s Electronic Data Warehouse. 


Enterprise Fraud Management (EFM) | A technology identified as, Enterprise Fraud and Information Misuse 


solution Management (EFM) that is used to monitor and alert of suspected 
End-User activity at the access or transaction layer within targeted 
IT applications based on detection rules. 


End-User Refers to an employee or contractor of IRCC, or Overseas IRCC, or 
Other Government Departments (OGDs) who has a user account in 
and is provided access to IRCC applications. This includes 
privileged accounts. 

Entity A single unit of data that would have one or more attributes and 
may or may not have established relationships with a database or 
databases, other entity or entities, attribute or attributes, and a 
value or values. 

Fuzzy Search Refers to a search process, using approximate string matching, 
which returns results based on relevance, even if the search 
argument does not exactly correspond to the returned information. 

Graphical User Interface (GUI) A means to interact with a computer device through manipulation of 
graphical images and/or widgets (i.e. window or text box) in addition 
to text. 

A graphical web based software application used by an individual to 
retrieve, display and negotiate information resources. 
and/or module usually in the form of an electronic dashboard. 
combined to construct a more complex system. 


that they are validated in a top down manner 

Official Language(s) A language or languages given special legal status. In the context 
of this requirement, this term refers to the two official languages of 
Canada - English and French. 
available product. 


Pre-defined Timeframe A distinct period of time that has been determined or set in advance 
of an anticipated occurrence or state. In the context of this 


requirement, this term generally refers to a defined period of time 
that needs to have elapsed prior to the triggering of a business rule 
within the solution. 
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Project Contact Refers to a duly appointed IRCC point of contact for the EFM 


Solution implementation project. This is the channel to be used for 


all client-contractor communications during the implementation of 
EFM Solution. 


Proposal, Requirement Response or Refers to the complete response to the requirements stated in the 
Response requirement. 


Protected B The Protected B category of information, considered particularly 
sensitive, it can exist both in large quantities and in large 
concentrations within IRCC databases. The unauthorized disclosure 
of this information could cause serious injury to an individual (e.g. 
an IRCC client), organization (e.g. IRCC) or government. 


A place where data is stored and maintained, which may contain 
one or many entities. 
Annexes and Attachments listed therein. 

A procedure used for searching and extracting database records or 
content. 


In the context of this requirement, this term refers to a designated 
responsibility, accompanied by the granting of an authority within 
the EFM solution for a user to undertake specific tasks requiring 
access to the EFM solution. 

fraud or malfeasance. 

expected/anticipated value. 


security Information and Event A technology identified as, Security Information and Event 

Management (SIEM) Management (SIEM) that supports threat management and security 
incident response through the collection and analysis of security 
events from a wide variety of data sources in real time. 

SFP+ SFP+ is a hot-pluggable, small-footprint, serial-to-serial, multi-rate 
optical transceiver that is commonly used in 8.5GbE to 11GbE data 
communications and storage-area network (SAN). 


Switched Port Analyzer Refers to port mirroring or port monitoring, which selects network 
traffic for analysis by a network analyzer. 


system of Record A system of record (SOR) is a data management term for an 
information storage system (commonly implemented on a computer 


system running a database management system) that is the 
authoritative data source for a given data element or piece of 


information. 
access the data flowing across the computer network. 
Targeted IT application(s) An IT application that has been identified and listed within an 


inventory requiring the capturing of actions and/or the application of 
detection models. 

Task Authorization Refers to documentation specifying the details of the activities to be 
performed, a description of the deliverables, and a schedule 


indicating completion dates for the major activities or submission 
dates for the deliverables. The documentation will also include the 
applicable basis (bases) and methods of payment as specified in 
the Contract. 
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information. 
Tombstone Information Refers to the End-Users’ basic identifying information. e.g. Family 
ee Name, Given Name, Department, Office (Position), addresses, log- 
in ID, etc. 
The means by which information/data is transferred from one point 
to another. 

Treasury Board Travel Directive Refers to instructions issued by the Treasury Board of the 
Government of Canada regarding the treatment of travel 
expenditures. 

Twinaxial cabling, or "Twinax", is a type of cable similar to coaxial 
cable, but with two inner conductors instead of one. 

Refers to a list of actions or event steps defining the interactions 
between a user (actor) and a system, to achieve an objective. 


User Acceptance Testing Refers to verifications performed by IRCC to ensure proper 
functionality of the EFM Solution prior to sign-off on the work as 
accepted. 


User ID A term used to represent an identified End-User on a software, 
system, website or within any generic IT environment. It is used 
within any IT enabled system to identify and distinguish between 
the End-Users who access or use it. 


Value(s) Data that is added or associated with the field of a data repository, 
entity, attribute. 


Variable-Length Subnet Mask Variable-Length Subnet Masking (VLSM) amounts to "subnetting 
subnets," which means that VLSM allows network engineers to 


divide an IP address space into a hierarchy of subnets of different 
sizes, making it possible to create subnets with very different host 
counts without wasting large numbers of addresses. 


Wildcard(s) An unchanged defined character that can be used to represent 
ee other characters, when partial search information is all that is 
available. 

Workflow(s) Refers to the computerized facilitation or automation of a process, 
in whole or in part. Automation of business processes, in whole or 
in part, where documents, information, or tasks are passed from 
one participant to another for action, according to a set of rules. 


Workplace Investigations Refers to designated members of Workplace Investigations and 
Ethics Unit of IRCC’s Human Resources Branch responsible for 
administrative investigations (such as potential violations of the 


employee Values and Ethics Code including inappropriate access 
to IRCC networks). 
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Acronyms | Definitions LL ELLE 
ADM | Assistant Deputy Minister 
API | Application Programming Interfage _ S O 
ATO | Authority to Operate S 
BPR | Business Process Re-engineering O Z O Z U O 
BRD | Business Requirements Document ___ 
CBSA | Canada Border Services Agency ___ UU y O 
COTS | Commercial Off-The-Shelf __ S 
CSE | Communications Security Establishment 
| CSV | Comma Separated Values; or sometimes, Character Separated Values. 
DAM | Database Activity Monitoring = > Z S 
DAP | Database Audit Protection _ O Z o >Z S 
DLP | Data Loss Prevention > Z > S O 


Enterprise Data Center 
Electronic Data Warehouse. 
Enterprise Fraud Management 
Global Affairs Canada 
Government of Canada 
Refers to IRCC’s Global Case Management System enterprise application. 
Global Case Management System Privacy Mitigation Measures Working Group 
Graphical User Interface 
Human Resources 
HyperText Transfer Protocol Secure 
nstitute of Electrical and Electronics Engineers 
nternet Protocol 
mmigration, Refugees and Citizenship Canada 
nformation Technolog 
formation Technology Infrastructure Librar 
formation Technology Security Guidance 
nk Aggregation Control Protocol 
ghtweight Directory Access Protocol 
aster Services Agreement 
National Capital Region 
Open Document Format 
Project Management Board 
roject Oversight Committee 
uestion and Answer 
oyal Canadian Mounted Police 
ecurity Assessment and Authorization 
mall Form-factor Pluggable 
ecurity Information and Event Management 
Subject Matter Expert 
Statement Of Work 
Switched Port Analyzer 
Single Point Of Failure 
otructured Query Language 
security Requirements CheckList 
senior Review Board 
ecurity Requirements Traceability Matrix 
hared Services Canada 
ecure Sockets Layer 
erminal Access Point 


GCMS 
GCMS PMMWG 


HTTPS 


EEE 


RCC 


TIL 


> 


< 


ODF 


POC 


RCMP 


SIEM 


SRTM 


|W | WM) W|W| |W) W |W Z E a r i ra ri mm |G) OIO m m m 
6610121210) sma 6e 3x E DE 021100 
OT ICIZIEIM P= > DPR O|S|E 


TAP 


— 
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Appendix 2 to Annex A — IRCC Transactional Activity - Volumes 
1 — Total Concurrent and Unique Users 
The number of GCMS concurrent users peaks at approximately 3,000 per hour. 


The solution must monitor 30,000 users (IRCC and Other Government Departments). 


EFM Solution Authorized-Users || 


250 (2020-21) 


~5% growth per year 
Year 2 250 (2022-23) afterward 


Monitored End-Users 30,000 ~8% growth per year 


2 — Transactional Activity 


The table below outlines the projected transactional activity for IRCC, including growth per year basis. 


PROJECTED VOLUMES FOR IRCC TRANSACTIONS 

Fiscal Year Projected # Transactions 
~15% growth per year 

GCMS Transactions 2020-21 600,000,000 

All IRCC Application Transactions 


3 — GCMS Environment 


Currently, there are approximately 1,000 servers to support the GCMS system. The current use of these 
servers is broken down as follows: 


GCMS environment 


Production - 600 Windows OS 
- 200 Linux OS 
- Most servers are VMs 


Development - 200 Windows OS 
- 100 Linux OS 
- Most servers are VMs 
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Appendix 3 to Annex A - Indicative Business Rules 
IRCC has developed a set of indicative business rule requirements to be reviewed and verified. A 
Business Rule is defined as a rule that governs the alerts and notifications. The business rules are to be 


analyzed by the contractor prior to implementation. 


The Indicative Business Rules can be found in Attachment 2 to this contract. 
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Appendix 4 to Annex A — Resource Categories 
PERSONNEL QUALIFICATIONS 


Experience levels for each role, is defined as: 
e Junior Resource: Less than 5 years of experience 
e Intermediate Resource: 5 to 10 years of experience 
e Senior Resource: More than 10 years of experience 


Minimum role responsibilities are as follows: 
roject Manager 
Description Manage several Project Managers, each responsible for an element of the 
project and its associated project team; 
Manage the project during the development, implementation and operations 
startup by ensuring that resources are made available and that the project is 
developed and is fully operational within previously agreed time, cost and 
performance parameters; 
Formulate statements of problems; establish procedures for the development 
and implementation of significant, new or modified project elements to solve 
these problems, and obtain approval thereof; 
Define and document the objectives for the project; determine budgetary 
requirements, the composition, roles and responsibilities and terms of 
reference for the project team; 
Report progress of the project on an ongoing basis and at scheduled points in 
the life cycle; 
Meet in conference with stakeholders and other project managers and state 
problems in a form capable of being solved; 
Prepare plans, charts, tables and diagrams to assist in analyzing or displaying 
problems; work with a variety of project management tools; and, 
Project sign-off. 


Qualifications A minimum of one (1) year of project management experience in the 
installation, configuration, testing and implementation of an EFM solution 
comparable to the one being provided. 
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EFM Solution Architect 


Analyze existing capabilities and requirements, develop redesigned 


Description 


Qualifications 


Description 


Qualifications 


frameworks and recommend areas for improved capability and integration. 
Develop and document detailed statements of requirements; 

Evaluate existing procedures and methods, identify and document database 
content, structure, and application sub-systems, and develop data dictionary; 
Define and document interfaces of manual to automated operations within 
application sub-systems, to external systems, and between new and existing 
systems; 

Prototype potential solutions, provide tradeoff information and suggest 
recommended courses of action; 

Perform information modelling in support of Business Process Re-engineering 
(BPR) implementation; 

Perform cost/benefit analysis of implementing new processes and solutions; 
Provide advice in developing and integrating process and information models 
between business processes to eliminate information and process 
redundancies; and, 

Provide advice in defining new requirements and opportunities for applying 
efficient and effective solutions; identify and provide preliminary costs of 
potential options. 


A minimum of one (1) year of relevant hands-on working experience with the 
vendor proposed solution. 

A minimum of three (3) years of relevant hands-on working experience with 
an EFM solution comparable to the one being provided. 


Develop and document a detailed statement of requirements for the proposed 
alternative recommended in the preliminary analysis report; 

Perform business analyses of functional requirements to identify information, 
procedures, and decision flows; 

Evaluate existing procedures and methods, identify and document items such 
as database content, structure, application sub-systems, and develop data 
dictionary; 

Define and document interfaces of manual to automated operations within 
application sub-systems, to external systems, and between new and existing 
systems; 

Identify candidate business processes for re-design, prototype potential 
solutions, provide trade-off information and suggest a recommended course 
of action. Identify modifications to the automated processes; and, 

Support and use the selected departmental methodologies. 

Gather, analyze, and document, as well as translate into technical 
specifications business requirements; writing technical documents; 
negotiating business/technical requirements and project schedules with 
customers and other project team members. 


A minimum of three (3) years of experience conducting business systems 
analysis for EFM or similar type system implementations. 

A minimum of one (1) year of experience conducting business systems 
analysis for the vendor proposed solution. 
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System Administrator 
Description 


Qualifications 


Technical Architect 


Install, monitor, upgrade and maintain operating systems; 


Install, monitor, upgrade and maintain hardware and software; 

Work with Business Analysts, Project Managers, Developers, and 
clients/stakeholders to maintain and improve software performance; 

Apply problem solving skills to troubleshoot and resolve technical problems; 
Ensure timely and reliable system administration procedures, such as backup 
and/or recovery; and, 

Analyze system performance and recommend improvements. 

A minimum of two (2) years of experience installing, monitoring, upgrading, 
and maintaining the vendor proposed solution. 


Description 


Description 


Develop technical architectures, frameworks and strategies, either for an 
organization or for a major application area, to meet the business and 
application requirements; 

Identify policies and requirements that drive out a particular solution; 
Analyze and evaluate alternative technology solutions to meet business 
problems; 

Ensure the integration of all aspects of technology solutions; 

Evaluate potential hardware and software options relative to their ability to 
support specified requirements while taking into consideration their impact on 
potential and actual bottlenecks, in order to identify ways to optimize system 
performance; and, 

Review computer software systems and data requirements as well as 
communication and response needs and determine operating systems and 
languages needed to support them. 


A minimum of two (2) years of relevant hands-on working experience with the 
vendor proposed solution. 


Create and modify code and software; 

Create and modify screens and reports; 

Gather and analyze data for the conduct of studies to establish the technical 
and economic feasibility of proposed computer systems, and for the 
development of functional and system design specifications; 

Design methods and procedures for small computer systems, and sub- 
systems of larger systems; 

Develop, test and implement small computer systems, and sub-systems of 
larger systems; and, 


Produce forms, manuals, programs, data files, and procedures for systems 
and/or applications. 

A minimum of two (2) years of relevant hands-on working experience as a 
programmer/developer with the vendor proposed solution or an EFM solution 
comparable to the one being provided. 


Page 51 of 82 


000109 


Solicitation No. - N° de l'invitation 


B73 10-190250/B 
Client Ref. No. - N° de réf. du client 


B73 10-190250 


Database Analyst 


Define new database structures: 


Description 
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Define data conversion strategy; 

Define database conversion specifications; 

Finalize conversion strategy; 

Work collaboratively with the users in order to maintain and safeguard the 
database; 

Identify requirements for improvements to existing databases by determining 
users’ information requirements and system performance and functional 
requirements; 

Develop and implement procedures that will ensure the accuracy, 
completeness, and timeliness of data stored in the database; and, 

Advise programmers, analysts, and users about the efficient use of data. 


A minimum of two (2) years of relevant hands-on working experience as a 
database analyst with the vendor proposed solution or an EFM solution 
comparable to the one being provided. 


Training Specialist 
Description 


Assess the relevant characteristics of a target audience; 

Prepare Authorized-Users for implementation of courseware materials; 
Conduct training courses; and, 

Communicate effectively by visual, oral, and written form with individuals, 
small groups, and in front of large audiences. 


A minimum of one (1) year of relevant experience training clients in the 
proposed vendor solution or an EFM solution comparable to the one being 
provided. 


QA Analyst 
Description 


Lead development of test plans, test scripts and test data; 
Participate in functional and technical design reviews, perform 
integration/functional and system testing, and verify test results; 
Identify and document software defects; 

Participate with other project resources to resolve defects; and, 
Perform regression testing of software applications. 


A minimum of one (1) year of relevant hands-on working experience with the 
vendor proposed solution. 

A minimum of two (2) years of relevant hands-on working experience with an 
EFM solution comparable to the one being provided. 
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Test planning and coordination; 

Supervision of testing in accordance with the plan; 

Management and monitoring of test plans for all levels of testing; 
Management of walkthroughs and reviews related to testing and 
implementation readiness; 

Status reporting; 

Developing test scenarios and test scripts; 

Establishing and maintaining source and object code libraries for a multi- 
platform, multi-operating system environment: 

Establishing software testing procedures for unit test, integration testing and 
regression testing with emphasis on automating the testing procedures; 
Establishing and operating “interoperability” testing procedures to ensure that 
the interaction and co-existence of various software elements, which are 
proposed to be distributed on the common infrastructure, conform to 
appropriate departmental standards (e.g. For performance, compatibility, etc.) 
and have no unforeseen detrimental effects on the shared infrastructure; and, 
Establishing a validation and verification capability which assumes functional 
and performance compliance. 

A minimum of one (1) year of relevant hands-on working experience with the 
vendor proposed solution. 

A minimum of two (2) years of relevant hands-on working experience with an 
EFM solution comparable to the one being provided. 
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Appendix 5 to Annex A — IRCC High Level IT Infrastructure 


The IRCC/SSC computing infrastructure is comprised of the Linux and Windows operating systems and 
the distributed computing environment based on Windows operating system. This document describes 
each environment at a high level along with network, and hardware requirements that need to be met in 
order to run on IRCC/SSC’s standard computing infrastructure. 


STORAGE ENVIRONMENT 

a) SSC has a large service hosting environment at each Enterprise Data Center (EDC). This 
environment provides all SSC managed services (networking, security, directory services, 
authentication...) 

b) The SSC EDC hosting environments are configured to use new dedicated Government of 
Canada services, such as the federated directory services used for all user/group/computer 
management. 

c) The SSC EDC's services are managed by dedicated SSC personnel and applications specific to 
that EDC. 

d) IRCC data is housed within SSC Enterprise Data Centers. 

e) The data is accessed with the use of the Government of Canada community cloud (1 Gbps SMS) 
via virtual routing and forwarding. 

NETWORK ENVIRONMENT 
) All of IRCC’s infrastructure is owned and managed by SSC 
) All of IRCC’s servers (Hardware) are owned and managed by SSC 
c) AllofIRCC’s servers (Operating System) are managed by SSC 
d) All of IRCC’s servers (Applications) are owned and managed by IRCC 
) Domestic: 
i. Partner Organisations use a mix of PTP links (ex: RCMP), SMS links (ex: CBSA) and 
IPSEC Tunnels over SMS (ex: PPTC) to connect to the IRCC network. 
li. ALL IRCC Infrastructure owned and/or managed by SSC 
f) International: 
Owned by GAC managed by SSC. IRCC employees connect through IPSEC Tunnel and 
httos/CITRIX to run applications 


a 
b 


NETWORK TAPS 
Physical network TAPs are Netscout: Model 340-1094. 
Additional details: HD Fiber Tap, 1 Line/Link Fiber, 60/40, 50um, MM, 1U, LC 


Virtual network TAPs are Netscout: Model VSTREAM-0-008-5M. 


The Contractor will not be responsible for the installation of network TAPs. TAPs will be installed at the 
Enterprise Data Center (EDC). 


DESKTOP ENVIRONMENT 

Hardware: 

Desktop: CPU=i3, Mem=8GB, Disk=500GB, Laptop: CPU=i5 dual core, Mem=8GB, Disk=250GB, Tablet: 
CPU=i5 dual core, Mem=8GB, Disk=250GB. Evergreening is on a 5 year refresh cycle for computers. 
Procurement via SSC for roughly 2000/machines/year. Monitors are on an 8 year refresh cycle. 80% of 
IRCC employees have dual monitor configurations 


Software: 

Windows 10 Enterprise, Microsoft Office 2013, Symantec for Antivirus and McAfee for DLP, Java v8 is 
installed on all IRCC desktops because there are ~30 internal applications and TBS provided applications 
that require Java. Internet Explorer 11 is the IRCC standard browser for all Corporate Applications. 
Chrome is supported for internet and GCMS use. 
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ANNEX A - GEOGRAPHIC DISTRIBUTION 
12 Metropolitan Area Networks covering all 10 provinces and 2 territories. 
- 61/7 Network objects. 
- 950 Servers (Windows, Linux and other) 
- 11000 Workstations (rough estimate) 
o Nova Scotia 
= Halifax ( 5 network objects) 
= Sydney (2 network objects) 
o Prince Edward Island 
= Charlottetown ( 1 network object) 
o New Brunswick 
= Fredericton ( 11 network objects) 
= Moncton (12 network objects) 
o Newfoundland & Labrador 
=  St-John’s ( 7 network objects) 
o Quebec 
= Montreal ( 63 network objects) 
= Gatineau ( 18 network objects) 
o Ontario 
= NCR ( 294 network objects) 
= Southern Ontario ( 95 network objects) 
o Manitoba 
= Winnipeg ( 17 network objects) 
o Saskatchewan 
= Saskatoon ( 9 network objects) 
o Alberta 
= Edmonton ( 3 network objects) 
= Calgary ( 14 network objects) 
o British Columbia 
= Greater Vancouver ( 46 network objects) 
o Yukon 
= Whitehorse ( 2 network objects) 
o Northwest Territories 
= Yellowknife ( 18 network objects) 
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ANNEX B 


BASIS OF PAYMENT s.20(1)(b) 


1. INITIAL REQUIREMENT 
1.1. Firm Requirements 
1.1.1.Wave 1 Implementation 


Wave 1 ee 


Milestone 1 — Completion of WP1 to WP2 End of Period 2 


zJ Milestone 2 — Completion of WP3.1 to WP3.3 | Mid of Period 5 


| Milestone Description = 


Milestone 3 — Completion of WP3.4 to WP5 End of Period 6 
4 Milestone 4 — Completion of WP6 to WP7 End of Period 8 
Wave 1 Total: 


$2,640,000.00 


1.1.2.EFM Solution Software Licenses 


For the Non-Network Tap Software of the EFM Solution: 


EFM solution Software Licenses 
Authorized-User Licenses 


Firm Lot Price 


Description 
EFM Solution Software License including: 
Warranty (1 year), Annual Maintenance and 
Support and Technical Support 

o tes 
and Technical Support Year 1 
* For the EFM Solution Annual Maintenance and Support and Technical Support Year 1, following Wave 1 
Implementation Canada will pay an amount based on the firm annual price divided by 365 days and then multiplied 


by the number of days to the final day of the first contract year. In any subsequent year in which Canada exercises its 
option to obtain Maintenance, the full amount will apply on the existing Licensed Software. 
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1.1.3.Software Maintenance and Support for the Licensed Software 


EFM Solution Software Requirements Maintenance and Support 


Description Authorized-User Licenses Firm Price Year 2 


EFM Solution Software Annual Maintenance and 
Support and Technical Support 


Bi 


1.2. As and When Requested Services (Task Authorizations) 
1.2.1. Training (On an as and when requested basis) 


Course Description rn Unit Price Year1 | Price Year 2 | Price Year 3 


1 EFM Solution User Cost per person 


Classroom Cost per session 
EFM Solution User (English or French) (GoC (up to 15 
premises participants 
EFM Solution Administration Cost per person 
EFM Solution Administration (English or eae GOSI POr SESSION 
(GoC (up to 10 
French) = 
premises) participants) 


EFM Solution Business Rules Development Online Cost per person 
EFM Solution Business Rules Development “A Toomi a mae 
(GoC (up to 10 
(English or French) À a 
premises) participants) 
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1.2.2.Professional Services (On an as and when requested basis) 


A portion of the Work to be performed under the Contract may be required on an "as and when requested basis" using a Task 
Authorization (TA). 


The All Inclusive Daily Fixed Rates quoted below are firm for the periods specified commencing on Contract Award. 


Professional Services 


Service Category Per diem rate Year 1 | Per diem rate Year 2 | Per diem rate Year 3 


roject Manager Senior 

roject Manager Intermediate 

FM Solution Architect Senior 

FM Solution Architect Intermediate 
EFM Policy Specialist/Business System 
Analyst Senior 
EFM Policy Specialist/Business System 
Analyst Intermediate 
System Administrator Senior 
System Administrator Intermediate 
Technical Architect Senior 


| 8 | 
Lae | 
Technical Architect Intermediate 
ET 
B 
| 14 7 
15. 
RTS 
221: | 


Programmer / Developer Senior 
Programmer / Developer Intermediate 
Programmer / Developer Junior 
Database Analyst Senior 

Database Analyst Intermediate 
Database Analyst Junior 

Training Specialist Intermediate 
Quality Assurance Analyst Senior 
Quality Assurance Analyst Intermediate 
uality Assurance Analyst Junior 
esting Specialist Senior 

esting Specialist Intermediate 

esting Specialist Junior 


— 
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1.3 Optional Additional EFM Solution Software Licenses & Maintenance and Support 


1.3.1 Optional Additional EFM Solution Software Licenses 


_ Optional Additional EFM Solution Software Licenses 


Authorized- . 
ipti User 
Description I icense: Price Year 1 | Price Year 2 | Price Year 3 
Increment 


EFM Solution Software License including: 
Warranty (1 year), Annual Maintenance and Support 
and Technical Support 


1.3.2 Optional Additional EFM Solution Software Maintenance and Support 


n enance and Support 


Authorized- 
User Price Year 2 | Price Year 3 
Licenses 
Increment 
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2. EFM SOLUTION OPTION PERIODS 


2.1. Optional EFM Solution Software Maintenance & Support 


For fulfilling all of its obligations for maintenance and support for the non-network-tap EFM Solution software, the Contractor shall be paid an 
annual firm price as per the table below, in accordance with the Terms of Payment and Invoicing clauses identified herein, DDP (Delivered Duty 
Paid) to the delivery destination specified in this Contract, Customs Duty and Excise taxes included, packaging and shipping included, GST/HST 
extra. 


EFM Solution Software Requirements Maintenance and Support 
-Users Option Year 1 ion Year 2 | Option Year 3 | Option Year 4 | Option Year 5 | Option Year 6 | Option Year 7 


EFM Solution Software 
1 Annual Maintenance 

and Support and 

Technical Support 
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2.2. Optional As and When Requested Services (Task Authorizations) 


2.2.1 Training (On an as and when requested basis) 


Optional Training 


Course Description 


Option 
Year 1 


Option 
Year 2 


Option Option 
Year 3 Year 4 Year 5 


Option 
Year 6 


Option 
Year 7 


EFM Solution User Cost per person 
Giassroom Cost per session 
2 EFM Solution User (up to 15 
(GoC premises) GR 
participants 
EFM Solution 
EFM Solution Classroom = Se PEPSESSIOR 
4 De (up to 10 
Administration (GoC premises ape 
participants) 


EFM Solution Business Online Cost per person 
Rules Development janis 


r ion 
EFM Solution Business “OSL Per SESSIO 
Classroom (up to 10 
Rules Development Oe 
participants) 
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2.2.2 Professional Services (On an as and when requested basis) 


Optional Professional Services 


Per Diem Rates 


Service Category Level 


Option Year 1 | Option Year 2 | Option Year 3 | Option Year 4 | Option Year 5 | Option Year 6 
Project Manager Senior 


Intermediate 


il 


roject Manager 


FM Solution 

rchitect 

FM Solution 

rchitect 

FM Policy 

pecialist/Business Senior 
stem Analyst 

FM Policy 

pecialist/Business Intermediate 
stem Analyst 


Senior 


Intermediate 


O OO MIO V mS m S> M 


ystem Administrator | Senior 


(ep) 


System Administrator | Intermediate 
Technical Architect Senior 
Technical Architect Intermediate 
Programmer / Sanoi 
Developer 
l MeL Intermediate 
Developer 
Programmer / Juri 
unior 

Developer 

14 | Database Analyst Senior 
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Immigration, Refugees Immigration, Réfugiés 
i de i and Citizenship Canada et Citoyenneté Canada 
Information disclosed under the Access to Information Act 
L'information divulguée en vertu de la loi sur l'accès à l'information 


s.20(1)(b) 
Solicitation No. - N° de l'invitation Amd. No. - N° de la modif. Buyer ID - Id de l'acheteur 
B7310-190250/B 067EE 
Client Ref. No. - N° de réf. du client File No. - N° du dossier CCC No./N° CCC - FMS No./N° VME 


B73 10-190250 


Optional Professional Services 


Per Diem Rates 


Service Category Level : 
Option Year 1 | Option Year 2 | Option Year 3 | Option Year 4 | Option Year 5 | Option Year 6 | O 


Database Analyst Intermediate 
Database Analyst Junior 
Training Specialist Intermediate 
Quality Assurance Senior 
Analyst 

Quality Assurance Fes 
Analyst 

Q 


(ex 


uality Assurance Juhi 
unior 
Analyst 
Testing Specialist Senior 
Testing Specialist Intermediate 
Testing Specialist Junior 


= — — — as 
CO O0 NI O) 


20 
21 
22 

3 


2 
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Solicitation No. - N° de l'invitation Amd. No. - N° de la modif. Buyer ID - Id de l'acheteur s.20(1)(b) 
B7310-190250/B 067EE 
Client Ref. No. - N° de réf. du client File No. - N° du dossier CCC No./N° CCC - FMS No./N° VME 


B73 10-190250 


3. OPTIONAL ADDITIONAL EFM SOLUTION SOFTWARE REQUIREMENTS 


3.1. Optional Additional EFM Solution Software Licenses 


Optional Additional EFM Solution Software Licenses 


Authorized- 
Users 
Increment 


Price 


Option Year | Option Year | Option Year | Option Year | Option Year | Option Year | Option Year 
1 2 3 4 5 6 7 


Description 


EFM Solution Software 
License including: 
Warranty (1 year), Annual 


Maintenance and Support 
and Technical Support 


3.2. Additional EFM Solution Licenses Maintenance and Support 


Optional Additional EFM Solu e Maintenance and Support 


Authorized 
Description -Users Option Year | O Option Year | Option Year | Option Year | Option Year 
Increment 4 4 5 6 T 


EFM Solution Software 
Annual Maintenance and 
Support and Technical 
Support 
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Solicitation No. - N° de l'invitation 


B73 10-190250/B 
Client Ref. No. - N° de réf. du client 


B73 10-190250 


Amd. No. - N° de la modif. 


File No. - N° du dossier 


ANNEX C 


Immigration, Refugees Immigration, Réfugiés 
fi + il and Citizenship Canada et Citoyenneté Canada 
Information disclosed under the Access to Information Act 
L'information divulquée en vertu de la loi sur l'accès à l'information 


Buyer ID - Id de l'acheteur 


067EE 
CCC No./N° CCC - FMS No./N° VME 


SECURITY REQUIREMENTS CHECK LIST 
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i+] Immigration, Refugees Immigration, Réfugiés : 
and Citizenship Canada et Citoyenneté Canada i 
Information disclosed under the Access to Information Act : 
L'information divulquée en vertu de la loi sur l’accés à l'information 


` Contract Number / Numéro du contrat 


2014 o FO 


Government Gouvernement 
of Canada du Canada 


Security Classification Classification de sécurité 


| | SECURITY REQUIREMENTS CHECK LIST (SRCL) . 

LISTE DE VERIFICATION DES EXIGENCES RELATIVES A LA SECURITE (LVERS 
PART A= CONTRACT INFORMATION / PARTIE A INFORMATION © AEE aS E 
1. Originating Governrnent Department or Organization; = pe 3 
Ministère ou organisme gouvememental d'origine 


}. 


. 


e description du travail: 
i VETA 7 & & 


Yes | 


5, a Wili the supplier require access to Controlle 7 
Le fournisseur aura-til accès à des marchandises contrôlées? 
15. b) Will the supplier require-access to-unclassified military technical data subject to the provisions of the Technical Data Control 
Regulations? E Saa | | a | | aN 
Le fournisseur aura-t-il accès à des données techniques milltaires non classifiées qui sont assujetties.aux dispositions du Règlement 
sur le-contrôle dés données techniques? | 
6. Indicate the type.of access required / Indiquer le. type d'accés requis 
6. a} Will the supplier and its employees require access to PROTECTED-and/or CLASSIFIED information or assets? o | || No- E; 
Le fournisseur ainsi que les employés aurontils accès à des renseignements ou à des biens PROTEGES et/ou CLASSIFIÉS? Non 4 
(Specify the level of actess using the chart in Question 7. c) 
Préciser le niveau d'accès en utilisant le tableau qui se trouve à la question 7,€). nee 
6. b) Will the supplier and its employees (e.g. cleaners, maintenance personnel) require access to restricted access areas? No access to No Yes 
PROTECTED and/or CLASSIFIED information or assets is permitted. — l Non Oui 
Le fournisseur et ses employés (p, ex. nettoyeurs, personnel d'entretien) auront-ils accès a.des zones d'accès restreintes? L'accès 
à des renseignements ou à des blens PROTEGES et/ou CLASSIFIÉS n'est pas autorisé. : tix 
6. c) ls this a commercial courier of delivery requirement with ne-ovemight storage? | if No Yes 
S'agit-il d'un confrat de messagerie ou de llvralson commerciale Sans entreposage de nuit? | Non Oui 
uiréd to access / indiquer le t | 


No 
Non: 


Yes 
1 Oui 


7..a) Indicate the: yje of information thatthe supolier will be rea 


Canada 
7. b) Release restrictions / Restrictions relatives à la diffusion 
No.release restrictions | .  & AI NATO countries. 


No release restrictions. 
Aucune restriction relative [| 
a la. diffusion | 


Aucune restriction rélalive i Tous les pays de l'OTAN 
à ta diffusion 


Not releasable [| 


À ne pas diffuser 


Restricted to: 7 Limité à : | | 
Specify countryties): / Préciser te(s) pays : 


| Restricted to: / Limité à : 
Specify country(ies): / Préciser le(s) pays : 


Restricted to: / Limité à$ 
Specify countrylies}: / Préciser le(s) pays : 


7, c) Level of information / Niveau d'information 


| NATO NON CLASS 
PROTÉGÉ À | i NATO NON CLASSIFIF 
| NATO DIFFUSION R 
PROTEGE B | 


PROTECTED À [ | 
PROTEGEA _ à 


| PROTECTEDB ` ie 
| PROTEGE B 


| NATO DIFFUSION RESTREINTE 


TRES SECRET (SIGIN 


TBS/SCT 350-103(2004/12) 


Security Classification / Classification de sécurité 


3 Led 


1 
` TER PTS ett det 3 ; 2 a, heat P i i $ R A s t 
BEG SH LP ce iinit cat Late ne Ho uii un a hiet AN HOLDERS ASEENA ERIA rd ND AGP GRAN RER LE Ron th GA A EE a A kra praana AS i PTT Aere ET 


Peat HA A CE bp LE tL A me Let à qe AE PUF REM Are rithe PE EE Gt AE AL a FN AM ER AA LÀ PTT pe GS 


PERDANA EOE TEE ETA +r 


PROTECTED. C NATO CONFIDENTIAL Y “1 © | PROTECTED:¢ [| : 
PROTEGE C _NATO-GONFIDENTIEL | | PROTEGE C | : 
ee D. e (] | 
CONFIDENTIEL NATO SECRET. | } + » | CONFIDENTIEL : : 

| COSMIC. TOP SECRET [| . | SECRET [| : 
SECRET _ | COSMIC TRÈS SECRET l + | SECRET __ S } 
TOP SECRET E ! ‘| TOP SECRET | : 
TRÈS SECRET _ TRÈS SECRET ; 
| TOP SECRET (SIGINT) » TOP SECRET (SIGINT) E 
FRES SECRET (SIGINT) : 
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_ 144, à Will the production (manufacture, and/or repair and/or modification) of PROTECTED and/or CLASSIFIED material or equipment [y] No Yes 


fi $ il Immigration, Refugees 
and Citizenship Canada 


Immigration, Réfugiés 
et Citoyenneté Canada 


Information disclosed under the Access to Information Act 


L'information divulquée en vertu de la loi sur l'accès à l'information 


Contract Number / Numéro du contrat 


2011402850 
Security Classification / Giga fan de sécurité 


jeg Sc Gouvernement | 
of Canada du Canada 


PART A (continued) | PARTIE A (suite) a TINE aii 
8, Will the supplier require access to PROTECTED. and/or CLASSIFIED COMSEC information or assets? | No : 
Lė fourisseur aura-t-il accès à des renseignements ou à des biens COMSEC désignés PROTEGES et/ou CLASSIFIES? à Non 
if Yes, indicate the level: of sensitivity: 
Dans Paffirmative, indiquer le niveau-de sensibillté : nan 
9. Will the supplier require access to extremely sensitive INFOSEC information or assets? | 

Le fournisseur aura-t-il accès à des renselgnemeris ou à des biens INFOSEC de nature extrêmement délicate? 


+ 


No Yes 
Non Qui 


Short Title(s) of material / Titre(s) abrégé(s) du matériel : 

Document Number / Numéro du document : 2 
PART B « PERSONNEL (SUPPLIER) / PARTIE B= PERSONNEL (FOURNISSEU 
10. a) Personnel. security screening level required / Niveau de contrôle de la sécurité du perso 


~ 


+ 


R) HO Res A me sa e 
nnel requis 


[X] RELIABILITY STATUS CONFIDENTIAL SECRET | TOP SECRET 

| COTE DE FIABILITÉ. CONFIDENTIEL SECRET | TRÈS SECRET 
C] TOP SECRET- SIGINT. C] NATO CONFIDENTIAL [| NATO SECRET pi COSMIC TOP SECRET 
TRÈS SECRET ~ SIGINT | NATO CONFIDENTIEL NATO SECRET | COSMIC TRÈS SECRET 


| SITE ACCESS 
& ACCES AUX EMPLACEMENTS 


Special comments: 
Commentaires spéciaux : 


NOTE: If multiple levels of screening are identified, a Security Classification Guide must be provided, | | 
REMARQUE : Si plusieurs niveaux de contrôle de sécurité sont requis, un guide de classification de ja sécurité doit être fourni. 
10. b} May unscreened personnel be used for portions of the work? — [X No | Yes 
Du personnel sans autorisation sécuritaire peut-il se.voir confier des partles du travail? Non. Qui 
if Yes, will unscreened personnel be escorted? | No Yes 
Dans faffirmative, le personnel en question sera-t-l] escorte? Non Oul 


PART C - SAFEGUARDS (SUPPLIER) / PARTIE C - MESURES DE PROTECTION (FOURNISSEUR) 
INFORMATION / ASSETS / RENSEIGNEMENTS / BIENS 


44, a) Wil the supplier be required to receive and stare PROTECTED and/or CLASSIFIED information or assets on its site or [x] No Yes 
premilses? | | Non Our 
Le fournisseur sera-t-il tenu de recevoir et d'entreposer sur place des renseignements ou des biens PROTÉGÉS et/ou 
CLASSIFIÉS? 

11. b) Will the supplier be required to safeguard COMSEC information or assets? . [X No Yes 
Le fournisseur sera-t-il tenu de protéger des renseignements ou des biens COMSEC? Non |_jOui 


PRODUCTION 


Non Oul 


occur at the supplier's sit or premises? | 
Les installations-du fournisseur serviront-elles à la production (fabrication et/ou réparation et/ou modification) de matériel. PROTEGE 
et/ou CLASSIFIE? | Lo 


INFORMATION TECHNOLOGY (T) MEDIA 7 SUPPORT RELATIF À LA TECHNOLOGIE DE L'INFORMATION (TI) 


11. d} Will the supplier. be required to use its IT systems to electronically process, produce or store PROTECTED and/or CLASSIFIED Le iar 
LA 


information or data? | = | 
Le fournisseur sera-t-il tenu d'utiliser ses propres systèmes informatiques pour traiter, produire où stocker électroniquement des 


renselgnements ou des données PROTEGES et/ou CLASSIFIES? 


41, 6) Will there be an.electronic link between the supplier's IT systems and the govemment department or agency? No [~|Yes 
Disposera-t:on d'un lien électronique entre le système informatique du fournisseur et celui du Ministère ou de l'agence | Non Oui 
gouvemementale? , 


TBS/SCT 360-103(2004/12) . Security Classification / Classification de sécurité 


Canada 
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Hit phena babe ai ad a at mental de de ner At a 


[PART D - AUTHORIZATION / PARTIE D - AUTORISATION 


$ Immigration, Refugees 
and Citizenship Canada 


Immigration, Réfugiés i 
et Citoyenneté Canada : 


Information disclosed under the Access to Information Act : 
L'information divulguée en vertu de la loi sur l'accès à l'informatiĝn 


Government Gouvernement 
of Canada du Canada 


13. Organization Project Authority / Chargé de projet de l'organisme 


Name (print) - Nom (en lettres moulées) Title - Titre Signature : | 
Ralph shap. DG- tt th Bra | Li fe VA PS 
Mie Y . aa 


elephone No. - N° de pee - Facsimile No. - Nege tėtécopieur 


4, Organization Security Authority / Responsable. de la sécurité de en 


Narne (print) - Nom (en lettres moulées) Title - Titre 


Joe cans On 
En 


T5. Are there LR instructions (eg. aes Guide, T Classification Guide) hanes ec | 
Des instructions supplémentaires (p, ex. Guide de eos Guide de Een de la sécurité) sont-elles jointes? 


16, Pracurement Officer / Agent d'approvisionnement 


Name (print) - Nom (en lettres moulées) | _| Title - Titre Signature 


elephone No, - N° de téléphone Facsimile No. - N° de télécopieur | E-mail address - Adresse courriel ae a 


T. Contracting Security Authority / Autorité contractante en matière de sécurité 


ame (prinf-Marn fen lettres mnulés Title - Titre | Signature 
Denis Lecompte Digitally signed by 
Contract Security Officer, Contract Security Division Le com pte, Lecompte, Denis 
denis lecompte@tosge-pwesc.ge.ca a Dan : Date aoi 9.04.10 12:51:32 
TOULON E RN de télécopieur | E-mail address - Adresse couniel — Date j 
TBS/SCT 360-103(2004/12) Security Classification / Classification de sécurité | C dis 
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Hegap aah Aun parad narurut net 


PART C = (continued) I PARTIE C » (suite) 


fi $ il Immigration, Refugees 
and Citizenship Canada 


Immigration, Réfugiés 
et Citoyenneté Canada 


Information disclosed under the Access to Information Act 


L'information divulquée en vertu de la loi sur l'accès à l'information 


Contract Number / Numéro du contrat 
zoll oFSO _. 
Security Classification / Classifigation.de sécurité 
| y 4% 47 y 
b À 4 ` a À + a A 


Government Gouvernement 
of Canada du Canada 


For users completing the form manually use the summary chart below to indicate the categoryties) and level(s) of safeguarding required at the supplier's 
site(s) or premises, | | | 

Les utilisateurs qui remplissent le formulaire-manuellemerit doivent utiliser te tableau récapitulatif ci-dessous pour indiquer, pour chaque catégorie, les 
niveaux de sauvegarde requis aux installations du fournisseur. ne 


For users completing the form online (via the internet), the summary chart is automatically populated by your responses to previous questions. 


Dans le cas. des utilisateurs qui remplissent le formulaire en.ligne (par Internet), les réponses aux questions précédentes sont automatiquement saisies 


dans le tableau récapitulatif. | PAG : = 
E ‘SUMMARY CHART 7 TABLEAU RECAPITULATIF 


Category PROTECTED CLASSIFIED COMSEC 
Gatégaria. PROTEGE GLASSIFIE | 
CONFIDENTIAL |: Secrer | RESTRICTED | CONFIDENTIAL. CONFIDENTIAL 

CONFIDENTIEL F | NATO "NATO 
DIFFUSION = | CONFIDENTIEL 


CONFIDENTIEL 


a oF . 


La descripilon du travail visé par la présente LVERS est-elle de nature PROTEGEE etfau CLASSIFIEE? 


| 42. a) Is the description of the work contained within this SRCL PROTECTED and/or CLASSIFIED? E4 No Yes 


Non. Qui 


If Yes, classify this form by annotating the top and bottom in the area entitled “Security Classification”. 
Dans Faffirmative, classifler le présent formulaire on indiquant le niveau de sécurité dans la case intitulée 
« Classification de sécurité » au: haut et au bas du formulaire, l | 


12. 6) Will the documentation attached to this SRCL be PROTECTED and/or CLASSIFIED? : l No Yes 


La documentation associée à la présente LVERS sera-t-ellé PROTEGEE et/ou CLASSIFIEE? | TE Oui 


if Yas,.classify this form by annotating the top and bottom In the area entitled “Security Classification” and indicate with 
attachments (e.g. SECRET with Attachments), _ . he a a tue E 

Dans l'atfirmative, classifier le présent formulaire en Indiquant le niveau de sécurité dans la case intitulee 

« Classification de sécurité » au haut et au bas:du formulaire at indiquer qu’il y a des pièces jointes (p. ex. SECRET avec 
des pléces jointes), | 


THS/SCT 350-108(2004/12) 


Securily Classificatio 
N LO 


nf Sax one de sécurité 
GALM | 


re Peteh Kn rar Len run tro RASE a tp vA ARLES be ble Zak Quien bine Yd HE EL aad Sg re sagt rae niet ` ast, R a AT AR me DA | ne: . oe i 
x y TRE a tp ra ARAL EE Eco D panei DEET GEL A y EALA a AR LG PEN D PAL AP AA ra at fin SELF ESET E A HS RE APTS MR A CAT ST A TAATAAN A M ERTAN AE AA 3 RE pm HE TE TERE hitai NEED 


erase Pat | 


PR aA rs My adden, 
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fi + il and Citizenship Canada et Citoyenneté Canada 
Information disclosed under the Access to Information Act 
L'information divulquée en vertu de la loi sur l'accès à l'information 


Solicitation No. - N° de l'invitation Amd. No. - N° de la modif. Buyer ID - Id de l'acheteur 
B73 10-190250/B 067EE 
Client Ref. No. - N° de réf. du client File No. - N° du dossier CCC No./N° CCC - FMS No./N° VME 


B73 10-190250 


ANNEX D 


ELECTRONIC PAYMENT INSTRUMENTS 


The Bidder accepts to be paid by any of the following Electronic Payment Instrument(s): 


( ) VISA Acquisition Card; 

( ) MasterCard Acquisition Card: 

(X) Direct Deposit (Domestic and International); 
(X) Electronic Data Interchange (EDI); 

(X 
( 


X) Large Value Transfer System (LVTS) (Over $25M) 


Wire Transfer (International Only); 


) 
) 
) 
) 
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Solicitation No. - N° de l'invitation Amd. No. - N° de la modif. Buyer ID - Id de l'acheteur 
B73 10-190250/B 067EE 
Client Ref. No. - N° de réf. du client File No. - N° du dossier CCC No./N° CCC - FMS No./N° VME 


B73 10-190250 


ANNEX E 


FEDERAL CONTRACTORS PROGRAM FOR EMPLOYMENT EQUITY — CERTIFICATION 


|, the Bidder, by submitting the present information to the Contracting Authority, certify that the 
information provided is true as of the date indicated below. The certifications provided to Canada are 
subject to verification at all times. | understand that Canada will declare a bid non-responsive, or will 
declare a contractor in default, if a certification is found to be untrue, whether during the bid evaluation 
period or during the contract period. Canada will have the right to ask for additional information to verify 
the Bidder's certifications. Failure to comply with any request or requirement imposed by Canada may 
render the bid non-responsive or constitute a default under the Contract. 


For further information on the Federal Contractors Program for Employment Equity visit Empioyment and 
Social Development Canada (ESDC) — Labour's website. 


Date: (YYYY/MM/DD) (If left blank, the date will be deemed to be the bid solicitation closing 
date.) 


Complete both A and B. 
A. Check only one of the following: 
( ) A1. The Bidder certifies having no work force in Canada. 


( ) A2. The Bidder certifies being a public sector employer. 


( ) A3. The Bidder certifies being a 
Equity Act. 


federally reg Employment 


( ) A4. The Bidder certifies having a combined work force in Canada of less than 100 permanent full- 
time and/or permanent part-time employees. 


A5. The Bidder has a combined workforce in Canada of 100 or more employees; and 


(X) A5.1. The Bidder certifies already having a valid and current Agreement to Implement 


Employment Equity (AIEE) in place with ESDC-Labour. 


OR 

( ) A5.2. The Bidder certifies having submitted the Agreement to Implement Employment Equity 
(LAB1168) to ESDC-Labour. As this is a condition to contract award, proceed to 
completing the form Agreement to Implement Employment Equity (LAB1168), duly 


signing it, and transmit it to ESDC-Labour. 


B. Check only one of the following: 

( X )B1. The Bidder is not a Joint Venture. 

OR 

( ) B2. The Bidder is a Joint venture and each member of the Joint Venture must provide the 


Contracting Authority with a completed annex Federal Contractors Program for Employment 
Equity - Certification. (Refer to the Joint Venture section of the Standard Instructions) 
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Solicitation No. - N° de l'invitation 


B73 10-190250/B 
Client Ref. No. - N° de réf. du client 


B73 10-190250 


Amd. No. - N° de la modif. 


File No. - N° du dossier 


ANNEX F 


Immigration, Refugees Immigration, Réfugiés 
fi + il and Citizenship Canada et Citoyenneté Canada 
Information disclosed under the Access to Information Act 
L'information divulquée en vertu de la loi sur l'accès à l'information 


Buyer ID - Id de l'acheteur 


067EE 
CCC No./N° CCC - FMS No./N° VME 


TASK AUTHORIZATION FORM PWGSC-TPSGC 572 
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Task Authorization 
Autorisation de tâche 


Instruction for completing the form PWGSC - Instruction pour compléter le formulaire 


TPSGC 572 - Task Authorization 


(Use form DND 626 for contracts for the 
Department of National Defence) 


PWGSC - TPSGC 572 - Authorization de tache 
(Utiliser le formulaire DND 626 pour les 
contrats pour le ministère de la Défense) 


Contract Number 
Enter the PWGSC contract number. 


Contractor's Name and Address 
Enter the applicable information 


Security Requirements 
Enter the applicable requirements 


Total estimated cost of Task (Applicable taxes 
extra) 
Enter the amount 


Numéro du contrat 
Inscrire le numéro du contrat de TPSGC. 


Nom et adresse de l'entrepreneur 
Inscrire les informations pertinentes 


Exigences relatives a la sécurité 
Inscrire les exigences pertinentes 


Cout total estimatif de la tache (Taxes applicables 
en sus) 
Inscrire le montant 


For revision only Aux fins de révision seulement 


TA Revision Number 
Enter the revision number to the task, if applicable. 


Total Estimated Cost of Task (Applicable taxes 
extra) before the revision 

Enter the amount of the task indicated in the authorized 
TA or, if the task was previously revised, in the last TA 
revision. 


Increase or Decrease (Applicable taxes extra), as 
applicable 

As applicable, enter the amount of the increase or 
decrease to the Total Estimated Cost of Task (Applicable 
taxes extra) before the revision. 


1. Required Work: Complete sections A, B, C, and 
D, as required. 


A. Task Description of the Work required: 


Complete the following paragraphs, if applicable. 
Paragraph (a) applies only if there is a revision to 
an authorized task. 


(a) Reason for revision of TA, if applicable: 

Include the reason for the revision; i.e. revised 
activities; delivery/completion dates; revised costs. 
Revisions to TAS must be in accordance with the 
conditions of the contract. See Supply Manual 3.35.1. 
50 or paragraph 6 of the Guide to Preparing and 
Administering Task Authorizations. 


(b) Details of the activities to be performed (include 
as an attachment, if applicable) 


(c) Description of the deliverables to be submitted 
(include as an attachment, if applicable). 


(d) Completion dates for the major activities and/or 


Submission dates for the deliverables (include as 
an attachment, if applicable). 


PWGSC - TPSGC 572 (2014-04) 


Numéro de la révision de l'AT 
Inscrire le numéro de révision de la tache, s'il y a lieu. 


Cout total estimatif de la tache (Taxes applicables 
en sus) avant la révision 

Inscrire le montant de la tâche indiquée dans l'AT 
autorisée ou, si la tâche a été révisée précédemment, 
dans la dernière révision de l'AT. 


Augmentation ou réduction (Taxes applicables en 
sus), s'il y a lieu 

S'il y a lieu, inscrire le montant de l'augmentation ou de 
la réduction du Coût total estimatif de la tâche (Taxes 
applicables en sus) avant la révision. 


1. Travaux requis : Remplir les sections A, B, C et 
D, au besoin. 


A. Description de tâche des travaux requis : 


Remplir les alinéas suivants, s'il y a lieu : L'alinéa (a) 
s'applique seulement s'il y a révision à une tâche 
autorisée. 


(a) Motif de la révision de l'AT, s'il y a lieu : Inclure 
le motif de la révision c.-à.-d., les activités révisées, 
les dates de livraison ou d'achèvement, les coûts 
révisés. Les révisions apportées aux AT doivent 
respecter les conditions du contrat. Voir l'article 3.35. 
1.50 du Guide des approvisionnements ou l'alinéa 6 
du Guide sur la préparation et l'administration des 
autorisations de tâches. 


(b) Détails des activités à exécuter (joindre comme 
annexe, s'il y a lieu). 


(c) Description des produits a livrer (joindre comme 
annexe, s'il y a lieu). 


(d) Les dates d'achevement des activités principales 
et (ou) les dates de livraison des produits 
(joindre comme annexe, s'il y a lieu). 
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B. Basis of Payment: 

Insert the basis of payment or bases of payment that 
form part of the contract that are applicable to the task 
description of the work; e.g. firm lot price, limitation of 
expenditure, firm unit price 


C. Cost of Task: 
Insert Option 1 or 2: 


Option 1: 

Total estimated cost of Task (Applicable taxes extra): 
Insert the applicable cost elements for the task 
determined in accordance with the contract basis of 
payment; e.g. Labour categories and rates, level of 
effort, Travel and living expenses, and other direct costs. 


Option 2: 

Total cost of Task (Applicable taxes extra): Insert the 
firm unit price in accordance with the contract basis of 
payment and the total estimated cost of the task. 


D. Method of Payment 

Insert the method(s) of payment determined in 
accordance with the contract that are applicable to the 
task; i.e. single payment, multiple payments, progress 
payments or milestone payments. For milestone 
payments, include a schedule of milestones. 


2. Authorization(s): 

The client and/or PWGSC must authorize the task by 
signing the Task Authorization in accordance with the 
conditions of the contract. The applicable signatures and 
the date of the signatures is subject to the TA limits set 
in the contract. When the estimate of cost exceeds the 
client Task Authorization's limits, the task must be 
referred to PWGSC. 


3. Contractor's Signature 

The individual authorized to sign on behalf of the 
Contractor must sign and date the TA authorized by the 
client and/or PWGSC and provide the signed original and 
a copy as detailed in the contract. 


PWGSC - TPSGC 572 (2014-04) 


B. Base de paiement : 

Insérer la base ou les bases de paiement qui font partie 
du contrat qui sont applicables a la description du travail 
a exécuter : p. ex., prix de lot ferme, limitation des 
dépenses et prix unitaire ferme. 


C. Coût de la tâche : 


Insérer l'option 1 ou 2 


Option 1: 

Coût total estimatif de la tâche (Taxes applicables en 
sus) Insérer les éléments applicables du coût de la tâche 
établies conformément à la base de paiement du contrat. 
p. ex., les catégories de main d'œuvre, le niveau d'effort, 
les frais de déplacement et de séjour et autres coûts 
directs. 


Option 2 : 

Coût total de la tâche (Taxes applicables en sus) 
Insérer le prix unitaire ferme conformément à la base de 
paiement du contrat et le coût estimatif de la tâche. 


D. Méthode de paiement 

Insérer la ou les méthode(s) de paiement établit 
conformément au contrat et qui sont applicable(s) à la 
tâche; c.-à.-d., paiement unique, paiements multiples, 
paiements progressifs ou paiements d'étape. Pour ces 
derniers, joindre un calendrier des étapes. 


2. Autorisation(s) : 

Le client et (ou) TPSGC doivent autoriser la tâche en 
signant l'autorisation de tâche conformément aux 
conditions du contrat. Les signatures et la date des 
signatures appropriées sont assujetties aux limites 
d'autorisation de tâche établies dans le contrat . Lorsque 
l'estimation du coût dépasse les limites d'autorisation de 
tâches du client, la tâche doit être renvoyée à TPSGC. 


3. Signature de l'entrepreneur 
La personne autorisée à signer au nom de l'entrepreneur 
doit signer et dater l'AT, autorisée par le client et (ou) 
TPSGC et soumettre l'original signé de l'autorisation et 
une copie tel que décrit au contrat. 
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Ew _ Public Works and Government Travaux publics et Services nnex 
: | Services Canada gouvernementaux Canada Annexe 


Task Authorization Contract Number - Numéro du contrat 
Autorisation de tache 


Contractor's Name and Address - Nom et l'adresse de l'entrepreneur | Task Authorization (TA) No. - N° de l'autorisation de tâche (AT) 


Title of the task, if applicable - Titre de la tache, s'il y a lieu 


Total Estimated Cost of Task (Applicable taxes extra) 
Coût total estimatif de la tâche (Taxes applicables en sus) 


$ 


Security Requirements: This task includes security requirements 
Exigences relatives à la sécurité : Cette tâche comprend des exigences relatives à la sécurité 


| | No - Non | Yes - oui If YES, refer to the Security Requirements Checklist (SRCL) included in the Contract 
Si OUI, voir la Liste de vérification des exigences relative à la sécurité (LVERS) dans le contrat 


For Revision only - Aux fins de révision seulement 


TA Revision Number, if applicable Total Estimated Cost of Task (Applicable | Increase or Decrease (Applicable taxes 
Numéro de révision de l'AT, s'il y a lieu taxes extra) before the revision extra), as applicable 
Coût total estimatif de la tâche (Taxes Augmentation ou réduction (Taxes 
applicables en sus) avant la révision applicables en sus), s'il y a lieu 
$ $ 
Start of the Work for a TA: Work cannot commence Début des travaux pour I'AT: Les travaux ne 
until a TA has been authorized in accordance with the peuvent pas commencer avant que I'AT soit 
conditions of the contract. autorisée conformément au contrat. 


1. Required Work: - Travaux requis : 


A.Task Description of the Work required - Description de tache des travaux requis See Attached - Ci-joint | | 


B. Basis of Payment - Base de paiement See Attached - Ci-joint | | 


C. Cost of Task - Coût de la tâche See Attached - Ci-joint [| 


D. Method of Payment - Méthode de paiement See Attached - Ci-joint || 
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Annex 
Annexe 


Contract Number - Numéro du contrat 


2. Authorization(s) - Autorisation(s) 


By signing this TA, the authorized client and (or) the En apposant sa signature sur I'AT, le client 
PWGSC Contracting Authority certify(ies) that the autorisé et (ou) l'autorité contractante de TPSGC 
content of this TA is in accordance with the atteste(nt) que le contenu de cette AT respecte 
conditions of the contract. les conditions du contrat. 

The client's authorization limit is identified in the La limite d'autorisation du client est précisée 
contract. When the value of a TA and its revisions is dans le contrat. Lorsque la valeur de l'AT et ses 
in excess of this limit, the TA must be forwarded to révisions dépasse cette limite, l'AT doit être 
the PWGSC Contracting Authority for authorization. transmise à l'autorité contractante de TPSGC 


pour autorisation. 


Name and title of authorized client - Nom et titre du client autorisé à signer 


Signature Date 


PWGSC Contracting Authority - Autorité contractante de TPSGC 


Signature Date 


3. Contractor's Signature - Signature de l'entrepreneur 


Name and title of individual authorized - to sign for the Contractor 
Nom et titre de la personne autorisée à signer au nom de l'entrepreneur 


Signature 
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Solicitation No. - N° de l'invitation Amd. No. - N° de la modif. Buyer ID - Id de l'acheteur 
B73 10-190250/B 067EE 
Client Ref. No. - N° de réf. du client File No. - N° du dossier CCC No./N° CCC - FMS No./N° VME 


B73 10-190250 


ANNEX G 


CLAIM FOR PROGRESS PAYMENT FORM PWGSC-TPSGC 1111 
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$ Immigration, Refugees Immigration, Réfugiés 
and Citizenship Canada et Citoyenneté Canada 
mation disclosed under the Access to Information Act 


z | 
+i Public Works and Government Travaux publics et Services Claim for Prog ress ‘Pay MERE: ee 121i sur races aà l'information 


Services Canada gouvernementaux Canada Demande de paiement progressif 


If necessary, use form PWGSC-TPSGC 1112 to record detail costs 
Si nécessaire, utiliser le formulaire PWGSC-TPSGC 1112 pour inscrire les coûts détaillés 


Contractor's Name and Address Claim No. Date Contract Price - Prix contractuel 
Nom et adresse de l'entrepreneur N° de la demande YYYY-MM-DD / AAAA-MM-JJ 


File No. - N° du dossier Contract Serial No. 
N° de série du contrat 


Contractor's Procurement Business Number (PBN) Financial Code(s) - Code(s) financier(s) 
Numéro d'entreprise-approvisionnement (NEA) de l'entrepreneur 


Contractor's Report of Work Progress (if needed, use additional sheets) 
Compte rendu de l'avancement des travaux par l'entrepreneur (si nécessaire, utiliser des feuilles supplémentaires) 


Previous Claims 
Demandes précédentes Total to Date 


Total à date 


Current Claim 


Period of work covered by the claim N 
Demande courante 


Période des travaux visée par la demande 


Description: (Expenditures must be claimed in accordance with Tax 

the basis and/or method of payment of the contract) Rate (A +B) 
Description : (Les dépenses doivent être réclamées 

conformément à la base de paiement et (ou) à la méthode de Taux de 
paiement du contrat). taxe 


% 
% 
% 
% 


% 


% 


% 


% 


% 


% 


% 


% 


RPG TBS ve NO Subtotal 
l'entrepreneur Sous-total 
Contractor's QST No. 
No. de TVQ de Applicable taxes 
l'entrepreneur Taxes applicables 
eut Co 


Less holdbacks on expenditures only (Applicable taxes 
excluded) 

Moins les retenues sur les dépenses uniquement 
(Taxes applicables en sus) 


Total Amount of Claim (including applicable taxes) 
Montant total de la demande (incluant les taxes applicables) 


Percentage of the work completed of Current Claim > Amount due 
Pourcentage des travaux achevés x Demande courante Montant dû 
000137 


Tatin 
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Claim No. 


N° de la demande 


CERTIFICATE OF CONTRACTOR 


| certify that: 


- All authorizations required under the contract have been obtained. The 
claim is consistent with the progress of the work and is in accordance 
with the contract. 


- Indirect costs have been paid for or accrued in the accounts. 


- Direct materials and the subcontracted work have been received, 
accepted and either paid for or accrued in the accounts following receipt 
of invoice from supplier/subcontractor, and have been or will be used 
exclusively for the purpose of the contract. 


- All direct labour costs have been paid for or accrued in the accounts and 
all such costs were incurred exclusively for the purpose of the contract; 


- All other direct costs have been paid for or accrued in the accounts 
following receipt of applicable invoice or expense voucher and all such 
costs were incurred exclusively for the purpose of the contract; and 


- No liens, encumbrances, charges or other claims exist against the 
work except those which may arise by operation of law such as a lien 
in the nature of an unpaid contractor's lien and in respect of which a 
progress payment and/or advance payment has been or will be made 
by Canada. 


Contractor 's Signature - Signature de l'entrepreneur 


Check the box if the claim is being made with respect to advance 
payment provisions included in the basis of payment of the contract. 


[| 


This claim, or a portion of this claim, is for an advance payment. 
I certify that: 


- The funds received will be used solely for the purpose of the contract 
and attached is a complete description of the purpose to which the 
advance payment will be applied. 


- The amount of the payment is established in accordance with the 
conditions of the contract. 


- The contractor is not in default of its obligations under the contract. 
- The payment is related to an identifiable part of the contractual work. 


Contractor 's Signature - Signature de l'entrepreneur 


CERTIFICATES OF DEPARTMENTAL REPRESENTATIVES 


Scientific/Project/Inspection Authority: | certify that the work meets 
the quality standards required under the contract, and its progress is in 
accordance with the conditions of the contract. 


Inspection Authority (all other contracts): | certify that the quality of 
the work performed is in accordance with the standards required under 
the contract. 


Signature of Scientific / Project / Inspection Authority 


$ Immigration, Refugees Immigration, Réfugiés 
and Citizenship Canada 


Information disclosed under the Access to Information Act 


et Citoyenneté Canada 


l'information 
Contract Serial No. 
N° de série du contrat 


ATTESTATION DE L'ENTREPRENEUR 
J'atteste que : 


- Toutes les autorisations exigées en vertu du contrat ont été obtenues. 
La demande correspond à l'avancement des travaux et est conforme 
au contrat. 


- Les coûts indirects ont été réglés ou portés aux livres. 


- Les matières directes et les travaux de sous-traitance ont été reçus, et le 
tout a été accepté et payé, ou encore porté aux livres après réception de 
factures envoyées par le fournisseur ou le sous-traitant; ces matières et 
ces travaux ont été ou seront utilisés exclusivement aux fins du contrat. 


- Tous les coûts de la main-d'oeuvre directe ont été réglés ou portés aux 
livres et tous ces coûts ont été engagés exclusivement aux fins du contrat. 


- Tous les autres coûts indirects ont été réglés ou portés aux livres après 
réception des factures ou pièces justificatives pertinentes et tous ces 
coûts ont été engagés exclusivement aux fins du contrat. 


- Il n'existe aucun privilège ni demande ou imputation à l'égard de ces 
travaux sauf ceux qui pourraient survenir par effet de la loi, notamment le 
privilège d'un entrepreneur non payé à l'égard duquel un paiement 
progressif et(ou) un paiement anticipé a été ou sera effectué par le 
Canada. 


Title - Titre Date (YYYY-MM-DD / AAAA-MM-JJ) 


Cocher la case si la demande est faite en rapport avec les dispositions 

relatives aux paiements anticipés qui se trouvent dans la base de paiement 

du contrat. 

Cette demande, ou une partie de cette demande, est pour un paiement anticipé. 
J'atteste que : 

- Les fonds reçus ne serviront uniquement qu'aux fins du contrat; ci-joint 


est une description complète des fins auxquelles le paiement anticipé 
sera utilisé. 


- Le montant du paiement est établi conformément aux conditions du 
contrat. 


- L'entrepreneur n'a pas manqué a ses obligations en vertu du contrat. 


- Le paiement porte sur une partie identifiable des travaux précisés dans 
le contrat. 


Date (YYYY-MM-DD / AAAA-MM-JJ) 


ATTESTATIONS DES REPRESENTANTS DU MINISTERE 


Autorité scientifique ou responsable du projet / de l'inspection : 
J'atteste que les travaux sont conformes aux normes de qualité exigées 

en vertu du contrat et que leur avancement est conforme aux conditions 

du contrat. 


Responsable de l'inspection (tous les autres contrats) : J'atteste 
que la qualité des travaux exécutés est conforme aux normes exigées 
en vertu du contrat. 


Title - Titre 


Date (YYYY-MM-DD / AAAA-MM-JJ) 


Signature de l'autorité scientifique ou responsable du projet / de l'inspection 


Contracting Authority: | certify that, to the best of my knowledge, the 
claim is consistent with the progress of the work and is in accordance 
with the contract. This claim, however, may be subject to further 
verification and any necessary adjustment before final settlement. 


Contracting Authority Signature de l'autorité contractante 


Client's - (must sign the interim claim): | certify that the 
claim is in accordance with the contract. 


Client Signature du client 


Client's Authorized Signing Officer - (must sign the final claim): 

| certify that all goods have been received and all services have been 
rendered, that the work has been properly performed and that the 
claim is in accordance with the contract. 


Client Signature du client 
PWGSC-TPSGC 1111 (2014-11) 


Autorité contractante : J'atteste, au meilleur de ma connaissance, que la 
demande correspond à l'avancement des travaux et est conforme au contrat. 
Toutefois, cette demande pourrait faire l'objet d'une autre vérification et de 
tout rajustement nécessaire avant le règlement final.z 


Title - Titre Date (YYYY-MM-DD / AAAA-MM-JJ) 


Signataire autorise du client - (doit signer la demande provisoire) : 
J'atteste que la demande est conforme au contrat. 


Title - Titre Date (YYYY-MM-DD / AAAA-MM-JJ) 


Signataire autorisé du client - (doit signer la demande finale) : 
J'atteste que tous les biens ont été reçus, que tous les services ont ete 
rendus, que tous les travaux ont été exécutés convenablement, et que 
la demande est conforme au contrat. 


Date (YYYY-MM-DD / AAAA-MM-JJ) 
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Title - Titre 


Solicitation No. - N° de l'invitation 


B73 10-190250/B 
Client Ref. No. - N° de réf. du client 


B73 10-190250 


Amd. No. - N° de la modif. 


File No. - N° du dossier 


ANNEX H 


Immigration, Refugees Immigration, Réfugiés 
fi + il and Citizenship Canada et Citoyenneté Canada 
Information disclosed under the Access to Information Act 
L'information divulquée en vertu de la loi sur l'accès à l'information 


Buyer ID - Id de l'acheteur 


067EE 
CCC No./N° CCC - FMS No./N° VME 


SOFTWARE PUBLISHER CERTIFICATION FORMS 
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Solicitation No. - N° de l'invitation 


B73 10-190250/B 
Client Ref. No. - N° de réf. du client 


B73 10-190250 


Amd. No. - N° de la modif. 


File No. - N° du dossier 
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Buyer ID - Id de l'acheteur 


067EE 
CCC No./N° CCC - FMS No./N° VME 
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$ Immigration, Refugees Immigration, Réfugiés 
and Citizenship Canada et Citoyenneté Canada 


2 us | | < | .20(1)(b Information disclosed under the Access to Information Act 
[ dy | Public Works and | Travaux publics ef 3 ( M L'information divulquée en vertu de la loi sur l'accès à l'information 
Q Government Services Services gouvernementaux 
Canada Canada 
Purchasing Office - Bureau des achats: Title - Sujet 
Systems Software Procurement Division / Division Enterprise Fraud Management 
des achats des logiciels d'exploitation Contract No. - N° du contrat Amendment No. - N° Modif 
Terrasses de la Chaudière B7310-190250/001/EE 002 
4th Floor, 10 Wellington Street Client Reference No. - N° de référence du client Date 
Ath etage, 10, rue Wellington B7310-190250 2022-03-10 
ee Requisition Reference No. - N° de la demande 
File No. - N° de dossier CCC No./N° CCC - FMS No./N° VME 
067ee.B73 10-190250 
Financial Codes GST/HST 
Code(s) financier(s) TPS/TVH 
CONTRACT AMENDMENT 
MODIFICATION AU CONTRAT 
The referenced document is hereby amended: unless 
otherwise indicated, all other terms and conditions of F.O.B. - F.A.B. 
the contract remain the same. 7 a Destination 
Ce document est par la présente modifié: sauf indication 
contraire, les modalités du contrat demeurent les mémes. GST/HST - TPS/TVH Duty - Droits 
The Vendor/Firm hereby accepts/acknowledges this See Herein - Voir ci-inclus See Herein - Voir ci-inclus 


amendment. — à - 
Le fournisseur/entrepreneur accepte la présente Destination - of Goods, Services, and Construction: 


modification/en accusé réception. Destination - des biens, services et construction: 
See herein 


Signature Date 
Name, title of person authorized to sign (type or print) 
Nom et titre du signataire autorisé (taper ou imprimer) 


Return signed copy forthwith 
Prière de retourner une copie dûment signée immédiatement 


Comments - Commentaires 


Invoices - Original and two copies to be sent to: 
Factures - Envoyer l'original et deux copies à: 
See herein 


Vendor/Firm Name and Address 
Raison sociale et adresse du 
fournisseur/de l'entrepreneur 


Veloitte LLP 
1600 - 100 Queen Street 
Ottawa 


iste Address Enquiries to: - Adresser toutes questions a: Buyer Id - Id de l'acheteur 


Canada Pignat, Michael 067ee 


Telephone No. - N° de téléphone FAX No. - N° de FAX 
(873)354-4163( ) ( ) - 


Increase (Decrease) - Augmentation (Diminution) 
$392,882.92 

Revised estimated cost 
Coût révisé estimatif 
$5,030,347.55 


Currency Type - Genre de devise 


CAD 


Igitally signed by: Pignat, Michae 


NYRA Michael" cm 


Jale. ZU 0S. T0 TS 4S 47 -05 U0 
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Information disclosed under the Access to Information Act 


7 4 7 Public Works and Travaux publics et s.20(1 )(b) L'information divulquée en vertu de la loi sur l'accès a l'information 
Government Services Services gouvernementaux 
Canada Canada 

Purchasing Office - Bureau des achats: Title - Sujet 

Systems Software Procurement Division / Division Enterprise Fraud Management 

des achats des logiciels d'exploitation Contract No. - N° du contrat Amendment No. - N° Modif 

Terrasses de la Chaudière B7310-190250/001/EE 002 

4th Floor, 10 Wellington Street Client Reference No. - N° de référence du client 

Ath etage, 10, Tue Wellington B7310-190250 

ti 

a Requisition Reference No. - N° de la demande 

KIA 085 B7310-190250 
File No. - N° de dossier CCC No./N° CCC - FMS No./N° VME 
067ee.B7310-190250 
Financial Codes GST/HST 
Code(s) financier(s) TPS/TVH 


DRAFT - PROJET 
CONTRACT AMENDMENT 
MODIFICATION AU CONTRAT 


The referenced document is hereby amended: unless 
otherwise indicated, all other terms and conditions of FOB. -FAB. 
the contract remain the same. 


i au D Destination 
Ce document est par la présente modifié: sauf indication 
contraire, les modalités du contrat demeurent les mêmes. GST/HST - TPS/TVH Duty - Droits 
The Vendor/Firm hereby accepts/acknowledges this See Herein - Voir ci-inclus See Herein - Voir ci-inclus 


amendment. 
Le fournisseur/entrepreneur accepte la présente Destination - of Goods, Services, and Construction: 


modification/en accusé réception. Destination - des biens, services et construction: 
See herein 


Signature Dina Kamal, CN & Innovation Leader Date Mar 10, 2022 
Name, title of person authorized to sign {type or print) 
Nom et titre du signataire autorisé (taper ou imprimer) 


Return signed copy forthwith 
Prière de retourner une copie dûment signée immédiatement 


Comments - Commentaires 


Invoices - Original and two copies to be sent to: 
Factures - Envoyer l'original et deux copies à: 
See herein 


Vendor/Firm Name and Address 
Raison sociale et adresse du 
fournisseur/de l'entrepreneur 


Deloitte LLP 
1600 - 100 Queen Street 
Ottawa 


o Address Enquiries to: - Adresser toutes questions à: 
Canada Pignat, Michael 067ee 
Telephone No. - N° de téléphone FAX No. - N° de FAX 


Increase (Decrease) - Augmentation (Diminution) 


$392,882.92 

Revised estimated cost Currency Type - Genre de devise 
Coût révisé estimatif 

$5,030,347.55 CAD 


For the Minister - Pour le Ministre 
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Contract No. - N° du contrat Amd. No. - N° de la modif. Buyer ID - Id de l'acheteur 
B7310-190250/001/EE 002 067EE 
Client Ref. No. - N° de réf. du client File No. - N° du dossier CCC No./N° CCC - FMS No./N° VME 


W8486-184830 


AMENDMENT 002 


This amendment is raised to: 


Te 


2. 


1) 


2) 


Increase the Total Estimated Cost on page 1 of the Contract; 

Update Section 6. Task Authorization, Article 6.2 Task Authorization Limit; 
Update Section 8. Authorities, Article 8.3 Client Administrative Contact; 
Update Annex A Statement of Work, Section 6.2 Deliverables; 

Update Annex B Basis of Payment, Table 1.1.1 Wave 1 Implementation; 


Insert Work Package to Deliverables Table in Annex A Statement of Work 


At Page 1 Total Estimated Cost: 
DELETE: 
$4,637 ,464.63 
INSERT: 


$5,030,347.55 


At Section 6. Task Authorization, Article 6.2 Task Authorization Limit 
DELETE: 


The Client Administrative Contact may authorize individual task authorizations up to a limit of 
$65,000.00, Applicable Taxes included, inclusive of any revisions. 


Any task authorization to be issued in excess of that limit must be authorized by the Client 
Administrative Contact and/or Contracting Authority before issuance. 


INSERT: 


The Client Administrative Contact may authorize individual task authorizations up to a limit of 
$25,000.00, Applicable Taxes included, inclusive of any revisions. 


Any task authorization to be issued in excess of that limit must be authorized by the Client 
Administrative Contact and/or Contracting Authority before issuance. 


000143 


Immigration, Refugees Immigration, Réfugiés 
fi + il and Citizenship Canada et Citoyenneté Canada 
Information disclosed under the Access to Information Act 
L'information divulquée en vertu de la loi sur l'accès à l'information 


Contract No. - N° du contrat Amd. No. - N° de la modif. Buyer ID - Id de l'acheteur 
B7310-190250/001/EE 002 067EE 
Client Ref. No. - N° de réf. du client File No. - N° du dossier CCC No./N° CCC - FMS No./N° VME 


W8486-184830 


3) At Section 8. Authorities, Article 8.3 Client Administrative Contact 
DELETE: 


The Client Administrative Contact is: 


Name: Joanne Dubeau 

Title: Senior Procurement Officer 

Organization: Immigration, Refugees and Citizenship Canada 
Address: 70 rue Crémazie Gatineau, QC K1A 1L1 
Telephone: 873-408-0518 

E-mail address: Joanne Dupeau@cic.ac. 


The Client Administrative Contact must receive the original Invoice. All inquiries for request for 
payment must be made to the Client Administrative Contact. 


INSERT: 


The Client Administrative Contact is: 


Name: Micheline Lafontaine 

Title: Senior Procurement Officer 

Organization: Immigration, Refugees and Citizenship Canada 
Address: 70 rue Crémazie Gatineau, QC K1A 1L1 
Telephone: 343-553-7630 


Vicneline.Lafontaine@cic.ac. 


E-mail address: 


The Client Administrative Contact must receive the original Invoice. All inquiries for request for 
payment must be made to the Client Administrative Contact. 


4) Annex A Statement of Work, Section 6.2 Deliverables 


DELETE: 


Milestone / | Description Forecast 

Deliverable (Business days 
from Contract 
award date) 


“Contract Award” 


Technical Team engagement with Supplier 


Deliverable Project Plan including Schedule and Work Breakdown 


D01 Structure (WBS) 


Deliverable Risk Mitigation Strategies and Plan 
D02 
Contract Award 


E | Status Reports Ongoing 
ll 


Milestone Start a ae of the solution 
Contract Award 
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e Deliverable Specifications and Acceptance Agreements No later than 40 
D04 (Upfront Deliverable Agreements (UDAs)) days from 
Contract Award 


Deliverable e Gap Analysis and recommendations to address gaps, No later than 40 
D05 if applicable days from 
Contract Award 


Deliverable e Complete Security Requirements Traceability No later than 40 
D06 Matrix (SRTM) — in consultation with Client. days from 
Contract Award 


Deliverable e Interview / workshop Schedule / plan No later than 40 
DO7 days from 
Contract Award 
Deliverable e Technical Solution Design No later than 40 
Contract Award 


Deliverable e Technical Configuration Document No later than 130 
D09 days from 
Contract Award 


Deliverable e Development Plan, if applicable No later than 50 
D10 days from 
Contract Award 
Deliverable e Configuration of business rules as defined in use cases. No later than 90 
D11 days from 
Contract Award 


Deliverable e Technical Design documents for reports, integrations, No later than 130 
D12 customizations, extensions and workflows, if applicable days from 
Contract Award 


D13 days from 
Contract Award 
D14 days from 
Contract Award 
Milestone Training of technical team on solution No later than 120 
days from 
Contract Award 
Milestone Integration of use cases and reports No later than 120 
days from 
Contract Award 
Milestone Testing/validation of final solution use cases and reports No later than 120 
days from 
Contract Award 
Deliverable Test Cases and Scripts No later than 120 
D15 days from 
Contract Award 
D16 days from 
Contract Award 


Milestone Approved Transition Plan No later than 110 
days from 
Contract Award 


Milestone Pilot testing and remediation No later than 120 
days from 
Contract Award 
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Deliverable Test Results and Defect Log No later than 120 
D17 days from 
Contract Award 


Milestone Necessary Privacy and Policy updates are completed No later than 120 
days from 
Contract Award 


Milestone Training of Workplace Investigations and Ethics (WIE) No later than 100 
days from 

Contract Award 

Milestone Stakeholder evaluation/approval to proceed No later than 110 
days from 

Contract Award 

Milestone Finalization of the solution No later than 130 
days from 

Contract Award 

Milestone Complete development of the solution No later than 130 
days from 

Contract Award 

D18 days from 
Contract Award 

D19 days from 
Contract Award 

Deliverable Deployment Test Results No later than 130 
D20 days from 
Contract Award 

Deliverable Configured Production Environment No later than 130 
D21 days from 
Contract Award 

Deliverable “go/no-go” checklist to be completed with input by IRCC No later than 130 
D22 days from 
Contract Award 

Milestone Start solution implementation No later than 140 
days from 

Contract Award 

days from 

Contract Award 

Milestone Evaluation/Remediation and update of use cases/reports No later than 160 
days from 

Administrator (technical) manuals No later than 160 
D23 days from 
Contract Award 

Deliverable User (business) manuals No later than 160 
Contract Award 


Milestone | Wave 1 | Wave 1 Implementation Project Close-Out Report | Project | Wave 1 Implementation Project Close-Out Report | Report Within 160 days 
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INSERT: 


Milestone / Description Forecast 


Deliverable (Business days 


from Contract 
award date) 


“Contract Award” 


Technical Team engagement with Supplier 
Deliverable e Project Plan including Schedule and Work Breakdown Delivered 
D01 Structure (WBS) 

Deliverable e Risk Mitigation Strategies and Plan 
D02 


Deliverable e Weekly Status Reports 
D03 


Start development of the solution 
Deliverable e Deliverable Specifications and Acceptance Agreements Delivered 
D04 (Upfront Deliverable Agreements (UDAs)) 

Deliverable e Gap Analysis and recommendations to address gaps, if Delivered 
D05 applicable 


Deliverable e Complete Security Requirements Traceability Matrix No later than 
DO6 (SRTM) per SOW — in consultation with Client. December 2022 


Deliverable e Interview / workshop Schedule / plan No later than 
DO7 December 2022 
Deliverable e Technical Solution Design No later than 
D08 December 2022 
Deliverable e Technical Configuration Document No later than 
D09 December 2022 
Deliverable e Development Plan, if applicable No later than 
D10 December 2022 
Deliverable e Configuration of business rules as defined in use cases. No later than 
D11 December 2022 


Deliverable e Technical Design documents for reports, integrations, No later than 
D12 customizations, extensions and workflows, if applicable December 2022 


Deliverable e Training manuals No later than 
D13 December 2022 
Deliverable e Training schedule No later than 
D14 December 2022 
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Milestone / Description Forecast 


Deliverable (Business days 


from Contract 
award date) 
Milestone Training of technical team on solution No later than 
December 2022 


Milestone Integration of use cases and reports No later than 

December 2022 
Milestone Testing/validation of final solution use cases and reports No later than 

December 2022 
Deliverable e Test Cases and Scripts No later than 
D15 December 2022 
Deliverable e Configured Test Environment for end-to-end solution No later than 
D16 December 2022 


Milestone Approved Transition Plan No later than 
December 2022 


Milestone Pilot testing and remediation No later than 

December 2022 
Deliverable e Test Results and Defect Log No later than 
D17 December 2022 


Milestone Necessary Privacy and Policy updates are completed No later than 
December 2022 


Milestone Training of Workplace Investigations and Ethics (WIE) No later than 

December 2022 
Milestone Stakeholder evaluation/approval to proceed No later than 

December 2022 
Milestone Finalization of the solution No later than 

December 2022 
Milestone Complete development of the solution No later than 

December 2022 
Deliverable e Deployment Approach and Prerequisites No later than 
D18 December 2022 
Deliverable e Deployment Test Plan No later than 
D19 December 2022 
Deliverable e Deployment Test Results No later than 
D20 December 2022 
Deliverable e Configured Production Environment No later than 
D21 December 2022 
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Milestone / Description Forecast 


Deliverable (Business days 
from Contract 
award date) 


Deliverable e “go/no-go” checklist to be completed with input by IRCC No later than 
D22 December 2022 
Milestone Start solution implementation No later than 
December 2022 
Milestone Completed full Implementation of the solution No later than 
December 2022 


Milestone Evaluation/Remediation and update of use cases/reports No later than 

December 2022 
Deliverable Administrator (technical) manuals No later than 
D23 December 2022 


Deliverable e User (business) manuals No later than 
D24 December 2022 


Wave 1 Implementation Project Close-Out Report December 2022 


5) At Annex B BASIS OF PAYMENT, Section 


DELETE: 


Wave 1 Total: $2,640,000.00 
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INSERT: 


Milestone 1 — Completion of D01 to D05 Completed and invoiced 


LS | Miestone 6 = Compton ofDS DH 


6) At Annex A Statement of Work 


INSERT: 


6.4 Work Packages to Deliverables Mapping 


: WP1-Project Initiation . D04. Project Plan including Schedule and WBS 

| . D02. Risk Mitigation Strategies and Plan 
: D03. Weekly Status Reports Template 
| D04. Deliverable Specifications and Acceptance Agreements (Upfront 
_ Deliverable Agreements (UDAs)) 


_ WP2-Solution Design & Gap D05. Gap Analysis and recommendations to address gaps, if applicable 
. Analysis = D06. Complete SRTM per SOW 
: _ D07. Interview / workshop Schedule / plan 
. D08. Technical Solution Design 
010. Development Plan... 
_ WP3-Development and | D09. Technical Configuration Document 
. documentation _ D11. Configuration of business rules as defined in use cases 
- _ D12. Technical Design documents for reports, integrations, customizations, 
_ extensions and workflows, if applicable 


_ WP4-System Testing | D15. Test Cases and Scripts 
: : D16. Configured Test Environment for end-to-end solution 
_ D17. Test Results and Defect Log 


_ WP5-Training . D14. Training schedule 
: _ D18. Training manuals 


_ WP6-Transition to prod & Go- : D18. Deployment Approach and Prerequisites 
live . D19. Deployment Test Plan 
. D20. Deployment Test Results 
. D21. Configured Production Environment 
_ D22. “go/no-go” checklist to be completed with input by IRCC 


- WP7-Operationalization - D23. Administrator (technical) manuals 
: D24. User (business) manuals 
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ALL OTHER TERMS AND CONDITIONS REMAIN UNCHANGED. 
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AMENDMENT 2 


APPENDIX B TO ANNEX A TASK AUTHORIZATION FORM 


Contractor: 


DELOITTE INC. E 


1001126 
(TA02) 
n MUNIN ist cnc RE 


4,916 (exclusive of tax) 


NEW 
Amendment #001 is raised to: 


e Amend the Description of the Project/Work required (highlighted in yellow) 

e Revise deliverables and their respective schedule 

e Increase the TA amount by $1,919,450 for services, plus $287,437.64 in applicable taxes for an 
overall increase of $2,206,887.64 


Task Authorization — Statement of Work 
GCMS DR Testing Capability 


Description of the Project / Work Required: 


Digital & System Integration Services - Emergency Response to COVID-19 


Immigration, Refugees and Citizenship Canada (IRCC) is seeking the services of a global organization(s) 
(the “Contractor”) with expertise in rapidly developing and implementing Digital solutions and 
supporting technologies in response to the recent global pandemic. COVID-19 has increased the urgency 
for IRCC to develop updated (1) new strategies, and (11) processes and digital systems to cope with the 
rapid change it is undergoing. These include updating systems and processes for internal staff, re-thinking 
and re-designing how IRCC provides its services to its clients within Canada and around the world, 
leveraging digital processes wherever possible thus minimizing the need for in-person interaction or 
paper-based processes for the safety of IRCC’s staff, clients and community. 


Specifically for this TA, the focus is on the integral digital system of Global Case Mananagement 
System (GCMS) and supporting the GCMS Disaster Recovery (DR) project. This is a work is required 
o ensure integral GCMS processes and digital systems are maintained during COVID-19, a top priority fo 

IRCC as it is a critical enabler of the Digital Platform Modernization (DPM) initiative which, in turn, is a 
op priority for the Government of Canada. 


The DR project is about to enter an intensive testing phase to validate that the application functions, as 
designed, on new infrastructure, in a new data center and that disaster recovery, performance, partne 
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interfaces, and local failovers work as expected. 


To date, project testing has used a shared model leveraging existing resources and approaches from the 
existing application support and development teams. Resource contention and competing priorities have 
led to delays in test execution and defect management. This has impacted the project schedule. The testing 
model needs to be changed to provide dedicated focus to testing and defect management. The projec 
needs a robust testing and defect management capability that can reliably deliver a tested application 
in accordance with the project schedule. 


The project also requires refinement of the post-cutover operating model to ensure streamlined operation 
in production between all involved stakeholders. 


IRCC requires the respondent to create and manage a testing capability for the project that would take the 
project through to implementation. The respondent would review the project’s current testing efforts anc 
propose an approach to complete the project. This would be reviewed with the project authority and, upo 
agreement, proceed to implementation which will allow for the GCMS DR project to meet the identified 
QA and operational goals within the defined project timelines. 


Background 


The Global Case Management System (GCMS) is an Immigration, Refugees and Citizenship Canada 
(IRCC) mission-critical application utilized by more than 16,000 users from IRCC and various othe 
government departments such as: Canada Border Services Agency (CBSA), Global Affairs Canada (GAC), 
Immigration and Refugee Board of Canada (IRB), Royal Canadian Mounted Police (RCMP), Employmen 
and Social Development Canada (ESDC) and others. Unavailability of this service can lead to borde 
closures and the inability to process travel visas and immigration requests. 


| Database with 604 
* personal records 


10,000 Electronic Travel Authorizations fe TA) 

applications received < 
+ SOK Users at IRCO, CASA, RCMP CH5, 

Final decisi $500 7 decid Ÿ GAC, ESDC 

Final decisions on 3,500 Temporary Resident “ee 


Visa applications 


si a: | Used at IRCC offices around 


Thousands of permanent residence decisions i mms Es ei sat 


Hundreds of inland asylurn claim eligibility 


; RA : ‘iho gets into Canada dvaitor. workers 
decisions i Wiho gets into Canada (visitors, workers, 


“ students), who becomes s permanent 


resident, and who becomes a citizen 


1,500 Citizenshia Grant and Proof application oe Dong 
i The vehicle for security, health, fraud and 


gh. P n ; «i + NÉ PRR : 
fna Hees program istegrity risks 


During the summer of 2015, Gartner Inc., in conjunction with IRCC and SSC conducted a GCMS 
Disaster Recovery (DR) analysis and recommended the implementation of a DR site at one (1) of the new 
SSC managed Enterprise Data Centers (EDCs). 


The GCMS Disaster Recovery (GCMS DR) project involves a migrating the existing production and 
staging environments for the GCMS application from the JETS data center to EDC Barrie. The disaster 
recovery site for the GCMS will be the SSC Gatineau data center. 


The GCMS production environment is configured to operate in a high availability mode with most 
components supporting fail over to a duplicate component in the event of a single or multiple component 
failure. The client facing portion of the GCMS service hub is built on a two-(2) node concept (one active, 
one inactive) to facilitate the deployment of GCMS functionality with minimal downtime. All productio 
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components operate out of a single datacenter (Jean Edmonds Tower South (JETS)) in downtown Ottawa, 

here is no secondary datacenter or fail-over site currently in place. This presents a high risk to IRCC and 
other GCMS stakeholders given that a serious outage affecting the datacenter could affect all IRCC services 
for an extended period of time. 


Currently, the project is being managed by a core IRCC/SSC team led by a pair of Directors — one from 
each department. The core team is focused on project management, architecture, design, and 
infrastructure provision. Other project tasks such as application builds, testing, defect fixes, and 
infrastructure are delivered via a sharing arrangement with IRCC’s IT-Operations and SSC’s Service 
lines. 


The project has completed design and development and is about to enter the testing phase. 
Current Testing Approach 


The project is currently completing the build of the Staging environments at EDC Barrie. Staging has 2 
environments — Staging A and Staging B and they are replicas of each other. They will be identical to the 
eventual Production A and B environments with the only difference being the capacity of the 
environments. The testing of these 4 environments represents the scope of this work. 


The same testing will be performed for each of the staging A/B and production A/B builds and it needs to 
verify: 


1. All GCMS functions perform as they do today in JETS on the new infrastructure, upgraded 
operating system, at EDC Barrie 


Partner connectivity functions as it does today 
GCMS has a sufficient level of performance 


New testing to confirm disaster recovery and failover testing between the A/B streams 


SR 


Testing to verify new infrastructure reacts in the way expected in the event of local issues 


o new GCMS functionality is being delivered as part of the project. The focus is on moving the GCMS 
application suite from JETS to EDC Barrie, upgrading operating systems, installing the application on 
new infrastructure, and creating a disaster recovery ability at a sister data center. 


The current test planning approach is to execute the same suite of test cases in each of the environments 
(Staging A/B, Production A/B). To exercise all the GCMS functions and verify the testing criteria, 
requires ~500 test cases. This was based on an analysis by the project team and the IT-OPS team that 
supports GCMS today. These test cases were developed and scripted during test planning and consist of a 
mix of automated and manual test cases. The existing GCMS QA test team estimates that execution is ~ 1 
est case per day. The current approach is to repeat the same suite of test cases in each of the 4 
environments. 


The current approach has defects handled by the development teams and managed through a ticketing 
system. Four development teams handle the majority of the defects: 


- Siebel 
- eServices 
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- Integration — Biztalk and a Message Exchange Layer based on MQ 
- ESO which handles the application builds. 


Capacity and priority contention between defects and other development activities leads to slow defect 
resolution which delays the project’s testing efforts. This is a key problem for the project that needs to be 
addressed through this Statement of Work. The project is currently attempting to complete testing in 
development and integration environments both of which are on the SDLC path prior to Staging and 


Production. 


The QA team uses Selenium test suite for automation and Loadrunner for performance testing. 


REVISED Statement of Work and Deliverables 


Stream I (Advisory) Scope: 


To execute the Stream I work, the activities that IRCC expects would include: 


e Understanding the current situation. This involves reviewing the existing test plans, approach, 
environments, resourcing plans, defects, deployment and testing processes and governance, and 
progress for the project. This would also include interviewing members of the project 
management, key testing participants, and reviewing existing documents, including the proposed 
test scripts. 


e Developing a proposed approach to complete testing for the DR project. This approach would 
include: 


Testing approach for testing planning, execution and defect fix. 


Resourcing model to execute the approach including defect fixes including how the 
acquire the right knowledge to execute defect fixes 


Approach to managing the testing process 
Requirements and resourcing from IRCC/SSC to support this approach 


Integration points and a proposed interaction model with the existing IRCC IT-Ops 
organization that support the GCMS application and release today. 


Approach for code package promotion through the environment stack balancing out needs 
for speed and quality 


Approach to reducing volume of operational work by ESO 
A list of the proposed testing deliverables. 


e An estimate, timeline, and proposed cost to complete the work. 


e The risk and issues associated with the proposed approach 


Testing Approach The proposed approach to testing that describes the proposed 
_ model for testing and defect management (informed by key 
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Workplan, Estimates, Resourcing To implement and execute the proposed approach. The 
estimate should include the underlying assumptions such as # 
of test cases, time to execute test case, # of defects, etc. It 
needs to provide visibility into the staffing model so IRCC 
can understand the resourcing implications 

Transition Approach Describes how the respondent would transition from the 
_ projects current testing model to the proposed approach with 


Critical Success Factors A list of the key assumptions and critical success factors that 
D will make the proposed approach successful. 
Deliverable Schedule and A list and description of the key testing deliverables that the 
: Description _ respondent would provide as they execute testing, — — 
Summary Presentation A summary of the approach, workplan and estimates that can 


be used at the DG/ADM level 


In addition to the aforementioned requirements around DR testing scope, there is a need to align the 
various stakeholder on the operating model for Day 2, post migration cutover into the new data centres. 
The request for the contractor is to help derive alignment by coordinating with the various stakeholders 
on areas of alignment, facilitating discussions and document the outcomes of the conversations. 


EW Stream II (Implementation Support) Scope: 


As part of Stream II, the contractor will be engaged to execute on the prioritized recommendations from 
he assessment and build process optimization and automation in order to ensure DR project can be 
delivered in a timely manner in accordance with DR project timelines. 


The contractor is required to augment the DR delivery team, especially in areas where capacity and 
capability gaps exists, in particular to the following functions: performance testing, test automation, ESO 
operations work. 


The contractor will also be required to continue managing and coordinating the various stakeholders 
involved to drive the Day 2 operating model work to completion including initiating the thinking on pre 


cutover dry runs and failover testing approach. 


EW Work Details: 


The Director for the GCMS project is Franck Desormiere. The responsible senior executive is Nancy 
Violette-Fehr. 
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4. Invoice sent to: IRCC.DSBFINANCEADMIN- 
DGSNFINANCEADMIN.IRCC@cic.gce.ca 
send copy of invoice to: carole.holden(@tpsgc- 


5. Travel Requirements: /A — All work to be conducted remotely. 


6. Language Requirements: English. 
7. Other Conditions / /A. 
Constraints: 


8. Level of Security Clearance [Reliability Status. 
Required for the Contractor 
Personnel: 


9. Contractor’s Response: 
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REVISED 9.1 Milestone/Deliverable and Services 


9.1.a Stream I Milestone/Deliverable 


This stream’s work is based on fixed cost by milestone as follows: 


1. Defect Management Optimization and Plans Week 4 
2. Code Promotion Approach i 


1. Test Strategy 

2. Failover Test Execution and Coordination Plans 

3. Recommendations for Environment Support and 
Operations 

4. Day 2 Operating Model Outline and Early Draft 


NEW 9.1.b Stream IT Milestone/Deliverable 


Milestone/Deliverable 


January Scope Completion * 29-Jan- 21 
Test Strategy Optimization Execution 19-Feb-21 
February Scope Completion * 26-Feb-21 


Prioritized Defect Management Recommendations 19-Mar-21 
Delivery 


Recommendations oe 


11-June-21 
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Deliverable and Milestone Inspection and Acceptance: The Project Lead, on behalf of the Technical 
Authority, will inspect and accept the deliverables (as outlined in section 1) and milestones within 3 
business days of submission from the Contractor, prior to payment processing. 


REVISED 9.2 Total Cost 


9.2.a Cost breakdown for Stream I: 


Category and Name of Propose 


Level 3 P.5 - Project Executive - 


Level 3 P.5 - Project Executive - 
Level 3 P.5 - Project Executive - 
Level 3 P.5 - Project Executive - 


Level 2 P.9 — Project Manager - QA 
/ Testing Manager - 

Level 2 — B.3 — Business Consultant 
- QA / Testing Sr Consultant - 


Level 2 P.9 — Project Manager - Ops 
Manager — 

Level 2 P.9 — Project Manager — Sr 
Deployment/ Release Process 
Engineer - a 
Level 2 — B.3 — Business Consultant 
Project Facilitation / Deliverable 


Support — 
Level 2 — P.9 — Project Manager — 
Day 2 OpModel Lead - 


Team members supporting integration with other Deloitte projects. Marginal efforts included 
with no associated cost 
Level 3 P.5 - Project Executive - 


Level 1 B.3 — Business Consultant — 
Project Consultant - 
Level 3 P.5 - Project Executive — 


| Level 3 P.5 - Project Executive — 
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L'information divulguée en vertu de la loi sur l'accès à l'information 


s.20(1)(b) 


_ this TA (Dec | 


Sub-Total of Stream I(Taxes Extra) $360.000.00 
A): os 


Applicable Taxes (B): $53,910.00 


Total Cost of Stream I (Taxes 
included) (C= A + B): $413,910.00 


- This work will be delivered at a firm fixed price as per the milestone / deliverable payment 
schedule above. The total fixed price $413,910 is reflective of applicable taxes (based on a tax 
rate of 14.975%) 

- The cost breakdown provided is reflective of estimated effort and assumptions at the time of TA 
submission. Actual hours may vary from these estimates over the course of delivery, but will 
not impact the price to deliver the scope described for the Stream I in this TA 


NEW 9.2.b Cost breakdown for Stream Il: 


Level 3 P.5 - Project Executive - 
Level 3 P.5 - Project Executive - 


Level 3 P.5 - Project Executive - 
Level 3 P.5 - Project Executive - 
Level 3 P.9 — Project Manager - QA 


/ Testing g 
Level 2 — P.9 — Project Manager — 


Delivery Enablement — 


Level 2 P.3 — Business Consultant — 
Delivery Enablement -TBC 
Level 2 P.9 — Project Manager — 
Testing — TBC 

Level 2 — A.6 — Programmer / 
Software Developer — TBC 
Level 2 — A.6 — Programmer / 
Software Developer — TBC 
Level 2 — A.6 — Programmer / 
Software Developer — TBC 
Level 2 — A.6 — Programmer / 
Software Developer — TBC 
Level 2 — I.9 — System 
Administrator - TBC 
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Level 1 — A.1 — Application / 
Software Architect - TBC 

Level 3 P.9 — Project Manager — 
Day 2 OpModel — 


Level 2 — P.9 — Project Manager — 
Day 2 OpModel — TBC 

Level 2 — B.3 — Business Tech 
Consultant — Day 2 OpModel — TBC 
Level 3 P.5 - Project Executive - 


Level 1 B.3 — Business Consultant — 
Project Consultant - 


Adjustment to price milestones / deliverables for this TA >= | 


Sub-Total of Stream II (Taxes Eu $1.919.450.00 
A): 


Reduction in total , - 
___amended Con | : 


included) (C= A + B): , 
& Stream II (taxes included) | ~ 


This Stream II work will be delivered at a firm fixed price as per the milestone / deliverable 
payment schedule above. The total price | 7 is reflective of applicable taxes (based 
on a tax rate of 14.975%) 

The cost breakdown provided is reflective of estimated effort and assumptions at the time of this 
TA submission. Number of resources and durations can be adjusted based on joint agreement 
between IRCC and Deloitte 


Deloitte will submit engagement payment invoice to IRCC every four (4) weeks based on work 
performed on a time and material basis based on work actually performed on the project 


9.3 Key Contractor Assumptions and Dependencies 


REVISED Assumptions 


The start date for the Stream I work will be December 23, 2020, and the end date will be February 
5, 2021 

The start date for the Stream IT work will be January 26, 2021, and the end date will be June 11, 
2021 

Activities and deliverables will be completed in collaboration with IRCC 

IRCC will identify the stakeholders to attend any information sessions and meetings 
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- IRCC will provide access to all required data and documents in a timely manner needed to 
complete the advisory stream (Stream I) of the engagement 

- IRCC will book interviews and ensure stakeholders provide necessary support for the engagement 

- Work will be conducted remotely via telephone and videoconferencing as appropriate 

- Deloitte and IRCC will confirm the deliverable sign-off process as part of the first week of work 
on this TA. This will include identifying who from IRCC will provide approval for each 
deliverable. 

- Deliverables and work products (1.e., presentation material, tools and templates) will be provided 
in English. Translation, if required, will be provided, in a timely manner, by IRCC. 

- Implementation of improvement recommendations e.g. roll-out and operation of defect 
management process, implementation of the recommended environment management approach 
as well as staffing of incremental resources are out of scope of Stream I 

- Depending on the security requirements, IRCC will provide a laptop and required access in a 
timely manner for the engagement 

- Completion of the work within this TA will not preclude Deloitte from providing support to 
additional IRCC initiatives and priorities 

- Open-source test automation framework e.g. Selenium will be leveraged to develop under 
Function B for Stream II 


REVISED Dependencies 


Stream I 

- Availability of IRCC personnel for key interviews and deliverable reviews across the following 
functions: development, testing, project management, ESO (operations) to establish the current state 

- Availability of project documents aforementioned to establish current state. If necessary, the 
required information will be gathered through interviewing stakeholders or observing project 
activities 

Stream II 

- Socialization of the Deloitte Stream II project mandate to project resources by IRCC leadership 

- Management support from project leadership (QM and ESO) 


- Alignment on accountability and signing authority for Day 2 Op-Model deliverables 


Name, Title and Signature of Individual Authorized to 
Sign on Behalf of Contractor 

Signature: 
Shannon Kot 


Date: August 27", 2020 


(type or print) 


Signatures (Client) 
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Name, Title and Signature of Technical Authority to 
Sign on Behalf of CIC 


(type or print) 
Name, Title and Signature of CIC Procurement 
Representative to Sign on Behalf of CIC 


(type or print) 


Name, Title and Signature of *Contracting Authority 
to Sign on Behalf of Public Works and Government 
services Canada 


(type or print) 


Immigration, Refugees Immigration, Réfugiés 
i + il and Citizenship Canada et Citoyenneté Canada 
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= Digitally signed by 
Najm, Najm, Omar 
Date: 2021.09.10 


Digitally signed by 
Strangemo strangemore, Jessica 


. Date: 2021.09.14 
Date: le, JESSICA 563530 0200 


Signature: 


Signature 
numérique de _ 
sr OÙ Chouinard, Judith 
Date: ON À Pté-2021 09 20 
08:50:03 -04'00' 


Signature: 


You are requested to sell to her Majesty the Queen in Right of Canada, in accordance with the terms and conditions set out herein, referred to 
herein, or attached hereto, the services listed herein and in any attached sheets at the price set out there of. 
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